We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Thunderbird < 138, and Thunderbird < 128.10.
Reserved 2025-04-29 | Published 2025-04-29 | Updated 2025-05-01 | Assigner mozillaUnsafe attribute access during XPath parsing
Ivan Fratric
bugzilla.mozilla.org/show_bug.cgi?id=1952465
www.mozilla.org/security/advisories/mfsa2025-28/
www.mozilla.org/security/advisories/mfsa2025-29/
www.mozilla.org/security/advisories/mfsa2025-31/
www.mozilla.org/security/advisories/mfsa2025-32/
Support options
