Description
A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
Published: 2025-06-24
Score: 9.8 Critical
EPSS: 1.1% Low
KEV: No
Impact: Crash (Denial of Service)
Action: Immediate Patch
AI Analysis

Impact

A use‑after‑free flaw exists in the FontFaceSet handling code. The flaw can cause a malformed memory access that leads to a browser crash, which may be exploited to cause a denial of service. The vulnerability is categorized as CWE‑416, a memory corruption weakness.

Affected Systems

The bug affects Mozilla Firefox and Thunderbird across their main releases and ESR branches. The advisory lists fixes in Firefox 140, Firefox ESR 115.25, and Firefox ESR 128.12, as well as in Thunderbird 140 and Thunderbird 128.12. All earlier versions are vulnerable.

Risk and Exploitability

The CVSS score of 9.8 signals a high‑severity flaw. The EPSS score of 1 % reflects a low, but non‑negligible, likelihood of exploitation. The advisory does not state whether this vulnerability is remotely exploitable; therefore the attack vector remains unspecified. The flaw is not listed in CISA’s KEV catalog, so no widespread exploits are currently known.

Generated by OpenCVE AI on April 20, 2026 at 20:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply an update to Firefox 140 or the ESR equivalents 115.25 or 128.12, and to Thunderbird 140 or 128.12.
  • If updating is temporarily infeasible, run the affected browsers in a restricted sandbox to limit the impact of a potential crash.
  • Continuously monitor crash logs and system stability reports for evidence of unexpected termination that may indicate exploitation attempts.

Generated by OpenCVE AI on April 20, 2026 at 20:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4231-1 firefox-esr security update
Debian DLA Debian DLA DLA-4239-1 thunderbird security update
Debian DSA Debian DSA DSA-5950-1 firefox-esr security update
Debian DSA Debian DSA DSA-5959-1 thunderbird security update
EUVD EUVD EUVD-2025-19086 A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12.
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History

Mon, 13 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12. A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Thu, 30 Oct 2025 16:00:00 +0000

Type Values Removed Values Added
Title firefox: thunderbird: Use-after-free in FontFaceSet Use-after-free in FontFaceSet

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00076}

 epss

{'score': 0.00092}

Fri, 04 Jul 2025 02:30:00 +0000

Type Values Removed Values Added
Title firefox: Use-after-free in FontFaceSet firefox: thunderbird: Use-after-free in FontFaceSet

Wed, 02 Jul 2025 20:45:00 +0000

Type Values Removed Values Added
Description A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12. A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, Firefox ESR < 128.12, Thunderbird < 140, and Thunderbird < 128.12.
References

Wed, 02 Jul 2025 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox

Wed, 02 Jul 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:8.8
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_e4s:9.2
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/a:redhat:rhel_tus:8.8
cpe:/o:redhat:enterprise_linux:10.0
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus

Wed, 02 Jul 2025 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:8
Vendors & Products Redhat
Redhat enterprise Linux

Thu, 26 Jun 2025 02:45:00 +0000

Type Values Removed Values Added
References

Wed, 25 Jun 2025 13:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 25 Jun 2025 00:30:00 +0000

Type Values Removed Values Added
Title firefox: Use-after-free in FontFaceSet
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 24 Jun 2025 12:45:00 +0000

Type Values Removed Values Added
Description A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12.
References

Subscriptions

Mozilla Firefox Firefox Esr
Redhat Enterprise Linux Rhel Aus Rhel E4s Rhel Els Rhel Eus Rhel Tus
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-04-13T14:26:04.861Z

Reserved: 2025-06-20T14:51:26.620Z

Link: CVE-2025-6424

cve-icon Vulnrichment

Updated: 2025-11-03T20:06:57.283Z

cve-icon NVD

Status : Modified

Published: 2025-06-24T13:15:23.273

Modified: 2026-04-13T15:17:06.127

Link: CVE-2025-6424

cve-icon Redhat

Severity : Important

Publid Date: 2025-06-24T12:27:59Z

Links: CVE-2025-6424 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-20T20:30:16Z

Weaknesses