CVE-2025-1009
📋 TL;DR
A use-after-free vulnerability in Firefox and Thunderbird allows attackers to cause potentially exploitable crashes via crafted XSLT data. This affects Firefox versions below 135 and specific ESR versions, plus Thunderbird versions below 128.7 and 135. Successful exploitation could lead to arbitrary code execution.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Firefox ESR
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the browser/email client user, potentially leading to full system compromise.
Likely Case
Browser/application crash leading to denial of service, with potential for code execution if combined with other vulnerabilities.
If Mitigated
Limited to denial of service if sandboxing and other browser security features prevent full exploitation.
🎯 Exploit Status
Exploitation requires crafting malicious XSLT data, but no public proof-of-concept has been released. The high CVSS score suggests reliable exploitation is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 135+, Firefox ESR 115.20+, Firefox ESR 128.7+, Thunderbird 128.7+, Thunderbird 135+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-07/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update check and installation. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable XSLT processing
allDisables XSLT transformation functionality in Firefox/Thunderbird to prevent exploitation.
about:config → Set 'dom.xslt.enabled' to false
🧯 If You Can't Patch
- Restrict access to untrusted websites and email sources
- Implement application whitelisting to prevent execution of malicious code
🔍 How to Verify
Check if Vulnerable:
Check browser/email client version against affected versions list.Check Version:
Firefox/Thunderbird: about:support → Application Basics → VersionVerify Fix Applied:
Confirm version is equal to or higher than patched versions: Firefox ≥135, Firefox ESR ≥115.20 or ≥128.7, Thunderbird ≥128.7 or ≥135.📡 Detection & Monitoring
Log Indicators:
- Browser/email client crash logs with XSLT-related stack traces
- Unexpected process termination events
Network Indicators:
- Requests to domains serving XSLT content
- Unusual outbound connections after visiting sites with XSLT
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="firefox.exe" OR ProcessName="thunderbird.exe" AND Keywords contains "XSLT"🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1936613
- https://www.mozilla.org/security/advisories/mfsa2025-07/
- https://www.mozilla.org/security/advisories/mfsa2025-08/
- https://www.mozilla.org/security/advisories/mfsa2025-09/
- https://www.mozilla.org/security/advisories/mfsa2025-10/
- https://www.mozilla.org/security/advisories/mfsa2025-11/
- https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html
