Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://www.mozilla.org/security/advisories/mfsa2025-87/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-88/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-89/ Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · mozillaNVD modified 2026-10-18 21:10
Affected (CPE criteria) 2
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
References 6
- https://bugzilla.mozilla.org/show_bug.cgi?id=1991458 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2025-87/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-88/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-89/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2025-90/
- https://www.mozilla.org/security/advisories/mfsa2025-91/