CVE-2025-1009 is a use-after-free vulnerability in Mozilla Firefox related to the processing of XSLT data. The flaw allows an attacker to cause a use-after-free condition, leading to a potentially exploitable crash. This vulnerability affects Firefox and Thunderbird versions prior to Firefox 135 and ESR 115.20/128.7. Mozilla has released official fixes in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. The CVSS v3.1 score is 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability enables an attacker to cause a use-after-free condition via crafted XSLT data, which can lead to a crash and potentially allow arbitrary code execution. The impact is rated high by Mozilla and the CVSS score of 9.8 reflects critical severity. Exploitation could compromise confidentiality, integrity, and availability of the affected systems. There are no known exploits in the wild at the time of the advisory.

Mozilla has released official patches fixing this vulnerability in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisory.