CVE-2025-0240

MediumCVSS 4.0/10Last modified Oct 5, 2026

Description

Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1929623Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-01/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-02/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-04/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-05/Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html

Timeline

Published: Jan 7, 2025
Last modified: Oct 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-02417.7When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was CVE-2025-02426.5Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5 CVE-2025-02435.1Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of CVE-2025-02445.3When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating CVE-2025-02453.3Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vul CVE-2025-02466.5When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. CVE-2025-02479.8Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that w CVE-2025-02488.1HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input. A re CVE-2025-02495.9HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers CVE-2025-02504.9HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being hand CVE-2025-02515.7HCL IEM is affected by a concurrent login vulnerability. The application allows multiple concurrent sessions using the same user credential CVE-2025-02524.8HCL IEM is affected by a password in cleartext vulnerability. Sensitive information is transmitted without adequate protection, potentially