CVE-2025-1931

Published: Mar 4, 2025Modified: Apr 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

Affected (5)

Products: Mozilla: Firefox, Thunderbird

2 products

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 136.0
Mozilla Firefox	Before 115.21.0
Mozilla Firefox	From 116.0 to 128.8.0
Mozilla Thunderbird	Before 128.8.0
Mozilla Thunderbird	From 129.0 to 136.0

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (7)

https://bugzilla.mozilla.org/show_bug.cgi?id=1944126

Source: security@mozilla.org

Issue Tracking

https://www.mozilla.org/security/advisories/mfsa2025-14/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-15/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-16/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-17/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2025-18/

Source: security@mozilla.org

Vendor Advisory

https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.