Threat Investigation
Request a demo

CVE-2025-5262

High

Description

A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.

SeverityHigh
CVSS7.5
Exploit probability—
ProductMozilla Thunderbird
PublishedMay 27, 2025
First seenMay 27, 2025
Weakness typeCWE-415CWE-415

How to fix

Update
  • mozilla thunderbird128.11.0, 139.0 or later

Affected products

ProductAffected versionsFixed in
mozilla thunderbirdv < 128.11.0, v < 139.0128.11.0, 139.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.