CVE catalog

CVE-2025-5262

Security update for MozillaThunderbird

Severity: Unknown
Published: May 27, 2025, 12:00:00 AM UTC
Updated: Apr 22, 2026, 4:04:51 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.46% · Oct 25, 2026

A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	mozjs52	18.04	`52.3.1-0ubuntu3`	vulnerable
Ubuntu	mozjs52	18.04	`52.3.1-7fakesync1`	vulnerable
Ubuntu	mozjs52	18.04	`52.8.1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mozjs52	18.04	`52.9.1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mozjs68	20.04	`68.5.0-1~fakesync`	vulnerable
Ubuntu	mozjs68	20.04	`68.5.0-2~fakesync`	vulnerable
Ubuntu	mozjs68	20.04	`68.6.0-1`	vulnerable
Ubuntu	mozjs68	20.04	`68.6.0-1ubuntu1`	vulnerable
Ubuntu	mozjs52	20.04	`52.9.1-1build1`	vulnerable
Ubuntu	mozjs52	20.04	`52.9.1-1ubuntu3`	vulnerable
Ubuntu	mozjs102	22.04	`102.11.0-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mozjs102	22.04	`102.12.0-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mozjs102	22.04	`102.13.0-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mozjs102	22.04	`102.15.1-0ubuntu0.22.04.1`	vulnerable
Ubuntu	mozjs78	22.04	`78.13.0-1`	vulnerable
Ubuntu	mozjs78	22.04	`78.15.0-2`	vulnerable
Ubuntu	mozjs78	22.04	`78.15.0-4ubuntu1`	vulnerable
Ubuntu	mozjs91	22.04	`91.5.1-0ubuntu1`	vulnerable
Ubuntu	mozjs91	22.04	`91.6.0-1`	vulnerable
Ubuntu	mozjs91	22.04	`91.6.0-2`	vulnerable
Ubuntu	mozjs91	22.04	`91.7.0-2`	vulnerable
Ubuntu	mozjs91	22.04	`91.10.0-0ubuntu1`	vulnerable
Ubuntu	mozjs102	24.04	`102.15.1-1`	vulnerable
Ubuntu	mozjs102	24.04	`102.15.1-3ubuntu2`	vulnerable
Ubuntu	mozjs115	24.04	`115.3.0-0ubuntu1`	vulnerable
Ubuntu	mozjs115	24.04	`115.4.0-2`	vulnerable
Ubuntu	mozjs115	24.04	`115.5.0-1`	vulnerable
Ubuntu	mozjs115	24.04	`115.6.0-1`	vulnerable
Ubuntu	mozjs115	24.04	`115.7.0-4`	vulnerable
Ubuntu	mozjs115	24.04	`115.8.0-1`	vulnerable
Ubuntu	mozjs115	24.04	`115.9.0-1`	vulnerable
Ubuntu	mozjs115	24.04	`115.9.0-1build1`	vulnerable
Ubuntu	mozjs115	24.04	`115.10.0-1`	vulnerable
Opensuse	MozillaThunderbird	tumbleweed	`128.11.0-1.1`	fixed
Opensuse	firefox-esr	tumbleweed	`128.11.0-1.1`	fixed
Suse	MozillaThunderbird	linux enterprise module for package hub 15 sp6	`128.11.0-150200.8.221.1`	fixed
Suse	MozillaThunderbird	linux enterprise module for package hub 15 sp7	`128.11.0-150200.8.221.1`	fixed
Suse	MozillaThunderbird	linux enterprise workstation extension 15 sp6	`128.11.0-150200.8.221.1`	fixed
Suse	MozillaThunderbird	linux enterprise workstation extension 15 sp7	`128.11.0-150200.8.221.1`	fixed
Opensuse	MozillaThunderbird	leap 15.6	`128.11.0-150200.8.221.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Opensuse	MozillaThunderbird	rpm	tumbleweed	`128.11.0-1.1`	Not reported	OPENSUSE-SU-2025:15174-1	Not reported
Opensuse	firefox-esr	rpm	tumbleweed	`128.11.0-1.1`	Not reported	OPENSUSE-SU-2025:15170-1	Not reported
Suse	MozillaThunderbird	rpm	linux enterprise module for package hub 15 sp6	`128.11.0-150200.8.221.1`	Not reported	SUSE-SU-2025:01946-1	Not reported
Suse	MozillaThunderbird	rpm	linux enterprise module for package hub 15 sp7	`128.11.0-150200.8.221.1`	Not reported	SUSE-SU-2025:01946-1	Not reported
Suse	MozillaThunderbird	rpm	linux enterprise workstation extension 15 sp6	`128.11.0-150200.8.221.1`	Not reported	SUSE-SU-2025:01946-1	Not reported
Suse	MozillaThunderbird	rpm	linux enterprise workstation extension 15 sp7	`128.11.0-150200.8.221.1`	Not reported	SUSE-SU-2025:01946-1	Not reported
Opensuse	MozillaThunderbird	rpm	leap 15.6	`128.11.0-150200.8.221.1`	Not reported	SUSE-SU-2025:01946-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[firefox-esr-branding-upstream]Unknown
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.11.0-1.1
  Version impact unknown
  pypi · firefox-esr · opensuse · tumbleweed
[firefox-esr-translations-common]Unknown
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.11.0-1.1
  Version impact unknown
  pypi · firefox-esr · opensuse · tumbleweed
[firefox-esr-translations-other]Unknown
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.11.0-1.1
  Version impact unknown
  pypi · firefox-esr · opensuse · tumbleweed
[MozillaThunderbird-openpgp-librnp]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.11.0-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaThunderbird-translations-common]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.11.0-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[MozillaThunderbird-translations-other]Unknown
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 128.11.0-1.1
  Version impact unknown
  pypi · MozillaThunderbird · opensuse · tumbleweed
[firefox-esr]Fixed
Source package: [firefox-esr]
Details (1)
- 153.1.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 128.11.0-1.1
  pypi · firefox-esr · opensuse · tumbleweed
[MozillaThunderbird]Fixed
Source package: [MozillaThunderbird]
Details (1)
- 140.14.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 128.11.0-1.1
  pypi · MozillaThunderbird · opensuse · tumbleweed

Observed: Oct 27, 2026, 1:56:26 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]