Use-After-Free Vulnerability in Firefox Affects Mozilla Products
CVE-2025-6424

9.8CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Firefox Esr
Thunderbird
Vendor
CVE Published:
24 June 2025

Badges

📈 Score: 173📰 News Worthy

What is CVE-2025-6424?

CVE-2025-6424 is a use-after-free vulnerability discovered in the FontFaceSet component of the Firefox web browser and affects multiple Mozilla products. This vulnerability arises when an application continues to use a pointer after the memory it points to has been freed, potentially leading to a crash. In practical terms, this flaw could enable an attacker to manipulate the behavior of the browser, potentially disrupting services or leading to unauthorized actions. Affected versions include Firefox versions earlier than 140, Firefox ESR versions earlier than 115.25, and Firefox ESR versions earlier than 128.12. Organizations that rely on these versions of Firefox may face increased risk of instability and exploitation if the vulnerability remains unaddressed.

Potential impact of CVE-2025-6424

  1. System Stability: The immediate risk is a potential crash of the affected software, impacting user experience and productivity within organizations that depend on the Firefox browser for day-to-day operations.

  2. Security Exploitation: Although there are no confirmed exploits in the wild at this time, the nature of the vulnerability could allow for the development of exploits that might lead to unauthorized access or manipulation of sensitive information within the browser environment.

  3. Wider Implications for Mozilla Products: Since this vulnerability affects multiple versions of Firefox and other Mozilla products, organizations using these tools may experience security challenges across their digital ecosystem, necessitating comprehensive patch management and security reviews to mitigate risks.

Affected Version(s)

Firefox < 140

Firefox ESR < 115.25

Firefox ESR < 128.12

News Articles

favicon imageCyberSecurityNews

Firefox 140 Released With Fix for Code Execution Vulnerability - Update Now

Mozilla has released Firefox 140, addressing multiple critical security vulnerabilities, including a high-impact use-after-free vulnerability that could lead to code execution. 

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1966423
https://www.mozilla.org/security/advisories/mfsa2025-51/
https://www.mozilla.org/security/advisories/mfsa2025-52/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by CyberSecurityNews

  • Vulnerability published

  • Vulnerability Reserved

Credit

LJP and HexRabbit (DEVCORE Research Team)
.
CVE-2025-6424 : Use-After-Free Vulnerability in Firefox Affects Mozilla Products