CVE-2025-1932
📋 TL;DR
A memory corruption vulnerability in Firefox and Thunderbird's XSLT processor could allow attackers to execute arbitrary code or cause denial of service. This affects Firefox versions before 136, Firefox ESR before 128.8, Thunderbird before 136, and Thunderbird ESR before 128.8.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Firefox ESR
- Mozilla Thunderbird
- Mozilla Thunderbird ESR
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment
Likely Case
Browser/application crash (denial of service) or limited information disclosure
If Mitigated
No impact if patched or if exploit attempts are blocked by security controls
🎯 Exploit Status
Requires user to visit malicious website or open malicious email/attachment
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 136+, Firefox ESR 128.8+, Thunderbird 136+, Thunderbird ESR 128.8+
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-14/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. Allow automatic update to complete. 4. Restart the application.
🔧 Temporary Workarounds
Disable JavaScript
allTemporarily reduces attack surface but breaks most websites
about:config → javascript.enabled = false
Use alternative browser
allSwitch to updated or unaffected browser until patched
🧯 If You Can't Patch
- Restrict access to untrusted websites and email attachments
- Implement network filtering to block known malicious domains
🔍 How to Verify
Check if Vulnerable:
Check Help → About Firefox/Thunderbird for version numberCheck Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Confirm version is Firefox ≥136, Firefox ESR ≥128.8, Thunderbird ≥136, or Thunderbird ESR ≥128.8📡 Detection & Monitoring
Log Indicators:
- Application crashes with XSLT-related stack traces
- Unexpected memory access errors in application logs
Network Indicators:
- Requests to domains serving XSLT content
- Unusual outbound connections after visiting websites
SIEM Query:
source="firefox.log" OR source="thunderbird.log" AND ("crash" OR "segfault" OR "xslt" OR "txNodeSorter")🔗 References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1944313
- https://www.mozilla.org/security/advisories/mfsa2025-14/
- https://www.mozilla.org/security/advisories/mfsa2025-16/
- https://www.mozilla.org/security/advisories/mfsa2025-17/
- https://www.mozilla.org/security/advisories/mfsa2025-18/
- https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html
