CVE-2025-13012CWE-362

CVE-2025-13012

High · published November 11, 2025

CVSS v3.1

7.5

EPSS

Percentile

14.6

In the wild

Unconfirmed

What it is

Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00243 · 14.6th percentile
Weakness: CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published: 2025-11-11T21:15Z

Affected products (3)

Product	Versions	Fixed in
mozilla/firefox	< 115.30.0	115.30.0
mozilla/firefox	< 145.0	145.0
mozilla/firefox	≥ 140.0, < 140.5.0	140.5.0

References (6)

https://bugzilla.mozilla.org/show_bug.cgi?id=1991458 · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-87/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-88/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-89/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-90/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2025-91/ · [email protected]

EPSS history

Timeline

11 NOV 15:47Z
Race condition in the Graphics component
cvelistv5