CoreCVE
Back

HIGH

Unsafe attribute access during XPath parsing

Published Apr 29, 2025

Description

A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10.

Affected products

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mozilla
Published Apr 29, 2025
Updated Apr 13, 2026
Reserved Apr 29, 2025
Link CVE-2025-4087
CISA Vulnrichment
Updated Apr 29, 2025
NVD
Status Modified
Modified Oct 5, 2026
Link CVE-2025-4087
Red Hat
Severity Moderate
Public date Apr 29, 2025
Links CVE-2025-4087 - Bugzilla
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a