CVE-2025-6424

CRITICAL 9.8CVE-2025-6424 · Published 24/06/2025 · updated 23/10/2026

Package	Affected versions	Patched versions
firefox mozilla	`≥ 116.0, < 128.12.0< 115.25.0< 140.0`	`128.12.0115.25.0140.0`

Description

A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

References

bugzilla.mozilla.org/show_bug.cgi · Permissions Required
mozilla.org/security/advisories/mfsa2025-51 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-52 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-53 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-54
mozilla.org/security/advisories/mfsa2025-55
lists.debian.org/debian-lts-announce/2025/06/msg00029.html
lists.debian.org/debian-lts-announce/2025/07/msg00002.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free