CVE-2025-5264 is a vulnerability in Mozilla Firefox and Thunderbird where the “Copy as cURL” feature does not properly escape newline characters. This insufficiency allows an attacker to craft a cURL command that, if executed by the user, could lead to local code execution on the user's machine. The vulnerability was addressed and fixed in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. The CVSS v3.1 base score is 4.8 (medium severity), with attack vector local, low attack complexity, low privileges required, and user interaction required. The vendor advisory confirms the fix and recommends updating to the patched versions.

Successful exploitation could result in local code execution on the user's system if the user is tricked into running a maliciously crafted cURL command copied from the browser. This could lead to limited confidentiality, integrity, and availability impacts on the affected system. There are no reports of active exploitation in the wild.

This vulnerability has been fixed by Mozilla in Firefox 139, Firefox ESR 115.24, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches.