CVE-2025-1012 describes a use-after-free vulnerability in Mozilla Firefox triggered by a race condition during concurrent delazification, a process related to JavaScript engine optimization. This memory safety bug could lead to exploitable crashes. Mozilla fixed this vulnerability in Firefox 135 and corresponding ESR and Thunderbird versions. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a critical remote code execution risk without user interaction or privileges. The vendor advisory explicitly lists this vulnerability among others fixed in the same release cycle.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely with no user interaction or privileges required, due to the use-after-free condition in the Firefox JavaScript engine. This could lead to complete compromise of the affected browser process and potentially the underlying system. No exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135. Users and administrators should update to these versions or later to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation actions are required beyond applying the official updates.