CVE-2025-6424CWE-416

CVE-2025-6424

Critical · published June 24, 2025

CVSS v3.1
9.8
EPSS
4%
Percentile
91.3
In the wild
Unconfirmed
What it is

🚨 A use-after-free vulnerability in FontFaceSet could lead to a crash that leaves your Firefox or Thunderbird feeling a bit tipsy! 🔥 Think of it like a waiter serving a dish that’s already been sent back to the kitchen — it’s an order that can lead to chaos if not dealt with correctly. When this happens in your browser, it could disrupt your entire experience, leaving you vulnerable to crashes and unexpected behavior. If exploited, this vulnerability could lead to a crash in your browser or email client, potentially allowing attackers to gain sensitive information or execute malicious code. It's critical because such crashes could be the gateway for more severe attacks, leaving your data in a precarious position. You wouldn't want your browser to become a stage for such trouble!

Put simply

Think of it like a waiter serving a dish that’s already been sent back to the kitchen — it’s an order that can lead to chaos if not dealt with correctly. When this happens in your browser, it could disrupt your entire experience, leaving you vulnerable to crashes and unexpected behavior. This vulnerability stems from a use-after-free error in the FontFaceSet interface, which fails to correctly manage memory, allowing an attacker to manipulate the application's state. This oversight could lead to a crash, opening the door for further exploitation.

What to do

If exploited, this vulnerability could lead to a crash in your browser or email client, potentially allowing attackers to gain sensitive information or execute malicious code. It's critical because such crashes could be the gateway for more severe attacks, leaving your data in a precarious position. You wouldn't want your browser to become a stage for such trouble! Update immediately to Firefox 140, Firefox ESR 115.25, or Thunderbird 140. If you're running an older version, it's crucial to prioritize this update and ensure that your systems are patched effectively. Regularly check for future updates as well! You've got this! By following these steps, you'll have your browser and email client secured in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04390 · 91.3th percentile
Weakness
CWE-416 · Use After Free
Published
2025-06-24T17:15Z
Affected products (3)
ProductVersionsFixed in
mozilla/firefox< 115.25.0115.25.0
mozilla/firefox< 140.0140.0
mozilla/firefox≥ 116.0, < 128.12.0128.12.0
References (8)
EPSS history
Timeline
  • 24 JUN 12:27Z
    Use-after-free in FontFaceSet
    cvelistv5