VYPR
← All advisories
High severity7.5NVD Advisory· Published Feb 4, 2025· Updated Apr 13, 2026

CVE-2025-1012

CVE-2025-1012

Description

A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A race condition in Firefox's concurrent delazification causes a use-after-free, potentially exploitable for code execution, fixed in Firefox 135 and Thunderbird 135.

Vulnerability

Details

CVE-2025-1012 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird caused by a race condition during concurrent delazification of JavaScript code. The bug was discovered by Nils Bars and reported via Bugzilla [1]. AddressSanitizer output confirms a heap-use-after-free read in the token stream during parsing [1].

Exploitation

An attacker can trigger this race by delivering specially crafted web content that forces concurrent delazification operations. No authentication is required; the vulnerability is remotely exploitable. In Thunderbird, scripting is disabled when reading email, so exploitation through email is unlikely, but it may be possible through other features that display remote web content [2][3].

Impact

Successful exploitation could lead to a potentially exploitable crash, and in the worst case, arbitrary code execution. The vulnerability is rated High severity with a CVSS v3 score of 7.5.

Mitigation

Mozilla has addressed this issue in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135 [2][3][4]. Users are advised to update their software to the latest versions.

References
  1. 1939710 - (CVE-2025-1012) AddressSanitizer: heap-use-after-free during delazification
  2. Security Vulnerabilities fixed in Thunderbird 135
  3. Security Vulnerabilities fixed in Thunderbird ESR 128.7
  4. Security Vulnerabilities fixed in Firefox 135

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

34

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

8

News mentions

0

No linked articles in our index yet.