CVE-2025-4087 — Unsafe attribute access during XPath parsing
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-…
Published: 2025-04-29 · CVSS: 4.8 · CVSS 3.1
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7