CVE-2025-4087: Unsafe attribute access during XPath parsing
A vulnerability was identified in Firefox where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption.
Other sources
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4087?
CVE-2025-4087 has a high severity as it can lead to out-of-bounds read access and potential memory corruption.
How do I fix CVE-2025-4087?
To fix CVE-2025-4087, update to Firefox version 138 or later, Firefox ESR version 128.10 or later, or the appropriate version for Thunderbird.
What software is affected by CVE-2025-4087?
CVE-2025-4087 affects Firefox versions prior to 138, Firefox ESR versions prior to 128.10, and Thunderbird versions prior to 138.
What kind of attacks can CVE-2025-4087 facilitate?
CVE-2025-4087 can facilitate attacks that exploit memory corruption vulnerabilities, potentially leading to system crashes or arbitrary code execution.
Is CVE-2025-4087 specific to desktop versions of the software?
CVE-2025-4087 affects desktop versions of Firefox and Thunderbird, including their ESR counterparts.