CVE Vulnerabilities

CVE-2025-5262

Published: May 27, 2025 | Modified: Aug 19, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
8.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

A double-free could have occurred in vpx_codec_enc_init_multi after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.

Affected Software

Name Vendor Start Version End Version
Firefox Ubuntu focal *
Mozjs102 Ubuntu esm-apps/noble *
Mozjs102 Ubuntu jammy *
Mozjs102 Ubuntu noble *
Mozjs115 Ubuntu devel *
Mozjs115 Ubuntu noble *
Mozjs115 Ubuntu oracular *
Mozjs115 Ubuntu plucky *
Mozjs52 Ubuntu esm-apps/focal *
Mozjs52 Ubuntu esm-infra/bionic *
Mozjs52 Ubuntu focal *
Mozjs68 Ubuntu esm-infra/focal *
Mozjs68 Ubuntu focal *
Mozjs78 Ubuntu esm-apps/jammy *
Mozjs78 Ubuntu jammy *
Mozjs91 Ubuntu jammy *
Thunderbird Ubuntu focal *

References