CVE-2025-0238

MediumCVSS 5.3/10Last modified Oct 5, 2026

Description

Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jan 7, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-02394.0When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerabilCVE-2025-02404.0Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. TCVE-2025-02417.7When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability wasCVE-2025-02426.5Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5CVE-2025-02435.1Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of CVE-2025-02445.3When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating CVE-2025-02453.3Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulCVE-2025-02466.5When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. CVE-2025-02479.8Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that wCVE-2025-02488.1HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A reCVE-2025-02495.9HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.  A token was not invalidated which may allow attackersCVE-2025-02504.9HCL IEM is affected by an authorization token sent in cookie vulnerability.  A token used for authentication and authorization is being hand