{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-5262", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-05-27T12:29:21.325Z", "datePublished": "2025-05-27T12:29:21.813Z", "dateUpdated": "2025-08-19T20:52:45.713Z"}, "containers": {"cna": {"affected": [{"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "139", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "128.11", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11."}]}], "problemTypes": [{"descriptions": [{"description": "Double-free in libvpx encoder", "lang": "en", "type": "text"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1962421"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-45/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-46/"}], "credits": [{"lang": "en", "value": "Randell Jesup"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2025-08-19T20:52:45.713Z"}}}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"credits": [{"lang": "en", "value": "Randell Jesup"}], "affected": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "139", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "128.11", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1962421"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-45/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-46/"}], "descriptions": [{"lang": "en", "value": "A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.", "supportingMedia": [{"type": "text/html", "value": "A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Double-free in libvpx encoder"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2025-08-19T20:52:45.713Z"}}, "adp": [{"providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-05-27T15:33:14.225Z"}, "title": "CISA ADP Vulnrichment"}]}, "cveMetadata": {"cveId": "CVE-2025-5262", "state": "PUBLISHED", "dateUpdated": "2025-08-19T20:52:45.713Z", "dateReserved": "2025-05-27T12:29:21.325Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-05-27T12:29:21.813Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11."}, {"lang": "es", "value": "Podr\u00eda haberse producido una doble liberaci\u00f3n en `vpx_codec_enc_init_multi` tras un error de asignaci\u00f3n al inicializar el codificador para WebRTC. Esto podr\u00eda haber causado corrupci\u00f3n de memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird (versi\u00f3n anterior a la 139) y Thunderbird (versi\u00f3n anterior a la 128.11)."}], "id": "CVE-2025-5262", "lastModified": "2025-08-20T14:40:17.713", "metrics": {}, "published": "2025-05-27T13:15:21.980", "references": [{"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1962421"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2025-45/"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2025-46/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "firefox: thunderbird: Double-free in libvpx encoder", "id": "2369143", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369143"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-415", "details": ["No description is available for this CVE."], "name": "CVE-2025-5262", "public_date": "2025-05-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-5262"], "threat_severity": "Critical"}