CVE-2025-4087

MediumCVSS 4.8/10Last modified Oct 5, 2026

Description

A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—

References

Timeline

Published
Apr 29, 2025
Last modified
Oct 5, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-40886.5A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on anyCVE-2025-408856.5A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authentCVE-2025-408868.8A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated uCVE-2025-408876.5A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated uCVE-2025-408886.5A SQL Injection vulnerability was discovered in the CLI functionality due to improper validation of an input parameter. An authenticated useCVE-2025-408898.1A path traversal vulnerability was discovered in the Time Machine functionality due to missing validation of two input parameters. An authenCVE-2025-40895.1Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, poCVE-2025-408907.9A Stored Cross-Site Scripting vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.CVE-2025-408914.7A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network tCVE-2025-408928.9A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. AnCVE-2025-408936.1A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An CVE-2025-408945.4A Stored HTML Injection vulnerability was discovered in the Alerted Nodes Dashboard functionality due to improper validation on an input par