CVE-2025-3028

Use‑after‑free vulnerability triggered by XSLTProcessor when JavaScript code runs during transformation can cause memory corruption. The improper deallocation may allow an attacker to manipulate the page context or execute arbitrary code, potentially compromising confidentiality, integrity, and availability of the system.

Mozilla Firefox and Thunderbird versions older than 137, or older ESR releases before Firefox ESR 115.22 or 128.9 and Thunderbird ESR 128.9. The vulnerability is also present in RedHat Enterprise Linux distributions that ship these browsers in the packages listed.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the short term, and the vulnerability is not yet listed in the CISA KEV catalog. The attack vector is inferred to be through malicious web content that uses XSLTProcessor, as the defect arises while processing JavaScript within a transformation. An attacker would need to supply or influence the document or script being processed, likely via XSS or a crafted link, to trigger the use‑after‑free. Once triggered, the resulting memory corruption could lead to arbitrary code execution or denial of service.