PT-2025-22987 · Mozilla+2 · Firefox+2

Randell Jesup · Published 2025-05-27 · Updated 2025-10-01 · CVE-2025-5262

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 139 Firefox ESR versions prior to 115.24 Firefox ESR versions prior to 128.11

Description A double-free issue could occur in the vpx codec enc init multi function after a failed allocation when initializing the encoder for WebRTC, potentially causing memory corruption and a crash.

Recommendations For Firefox versions prior to 139, update to version 139 or later. For Firefox ESR versions prior to 115.24, update to version 115.24 or later. For Firefox ESR versions prior to 128.11, update to version 128.11 or later.

Fix

RCE

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2025-11495

ALT-PU-2025-8611

CVE-2025-5262

MGASA-2025-0195

MGASA-2025-0197

OPENSUSE-SU-2025:15170-1

OPENSUSE-SU-2025:15174-1

SUSE-SU-2025:01946-1

Affected Products

Alt Linux

Astra Linux

Firefox

References · 51

• https://mozilla.org/en-US/security/advisories/mfsa2025-49 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-46 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-43 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-42 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0195 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-44 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-5262 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-45 · Vendor Advisory
• https://mozilla.org/en-US/firefox/128.11.0/releasenotes · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15170-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-42/#CVE-2025-5262 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5262 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5262 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15174-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0197.html · Security Note