CVE-2025-13012 is a race condition vulnerability identified in the Graphics component of Mozilla Firefox. This flaw was reported by Irvan Kurniawan and is tracked under Bug 1991458. It has a CVSS 3.1 base score of 7.5, indicating high severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. The vulnerability was fixed in Firefox 145 and Firefox ESR 140.5, as well as Thunderbird 145 and 140.5. The Mozilla advisories MFSA 2025-87 and MFSA 2025-88 provide official confirmation of the fix and additional context about related vulnerabilities.

The vulnerability allows for a race condition in the Graphics component, which can lead to high impact on confidentiality, integrity, and availability of the affected systems. Exploitation could potentially result in arbitrary code execution or other serious consequences. However, there are no known exploits in the wild at the time of the advisory.

Mozilla has released official fixes for this vulnerability in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is patched, no additional mitigation steps are required beyond applying the official updates.