CVE-2025-1931 is a high severity use-after-free vulnerability affecting the content process side of WebTransport connections in Mozilla Firefox and Thunderbird. This vulnerability could cause a crash that might be exploitable. It was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. The vulnerability is related to improper memory management (CWE-416) and has a CVSS 3.1 base score of 7.5, indicating a network attack vector with low attack complexity and no privileges or user interaction required, impacting availability. The vendor advisory confirms the fix and recommends updating to the patched versions.

The vulnerability could lead to a use-after-free condition causing a potentially exploitable crash in the content process of Firefox's WebTransport implementation. While no known exploits are reported in the wild, successful exploitation could impact the availability of the affected application and potentially lead to further compromise depending on the attacker's capabilities. The CVSS score of 7.5 reflects a high impact on availability with no direct confidentiality or integrity impact indicated.

Mozilla has released official fixes for this vulnerability in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official patches.