CVE-2025-4087 is a vulnerability identified in Mozilla Firefox and Thunderbird where XPath parsing lacks proper null checks during attribute access. This flaw can trigger undefined behavior resulting in out-of-bounds read access and potential memory corruption. The vulnerability is classified under CWE-125 (Out-of-bounds Read). It affects Firefox and Thunderbird versions prior to Firefox 138 and Thunderbird 138, including Firefox ESR 128.9 and Thunderbird 128.9. The issue has been addressed and fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. The CVSS v3.1 base score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impact with no availability impact. No exploits are known to be active in the wild.

The vulnerability allows an attacker to cause out-of-bounds read access and potentially memory corruption through unsafe attribute access during XPath parsing. This could lead to partial confidentiality and integrity impacts. However, the attack complexity is high and no privileges or user interaction are required. There are no reports of active exploitation in the wild. The vulnerability does not affect availability.

This vulnerability has been fixed by Mozilla in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. Users and administrators should apply these official updates to remediate the issue. No additional mitigation steps are required beyond updating to the fixed versions.