Mozilla Thunderbird 128.11 Security Update: Fixes CVE-2025-5262 to 5269 including RCE and Memory Corruption

Critical Vulnerability Information Vulnerability Overview Announcement Date: May 27, 2025 Impact: Critical Product: Thunderbird Fixed Version: Thunderbird 128.11 Specific Vulnerability Details 1. CVE-2025-5262: Double Free in libvpx Encoder - Reporter: Rendel Jesup - Impact: Critical - Description: A double free issue exists in the libvpx encoder, potentially leading to memory corruption and exploitable crashes. 2. CVE-2025-5263: Script Execution Error Handling Not Properly Isolated from Web Content - Reporter: Tatsuya - Impact: Medium - Description: Script execution error handling is not properly isolated from web content, potentially enabling cross-origin information leakage attacks. 3. CVE-2025-5264: Potential Local Code Execution in "Copy as cURL" Command - Reporter: Amazon Basics M K - Impact: Medium - Description: Due to insufficient escaping of newline characters in the "Copy as cURL" feature, attackers may trick users into using this command, leading to local code execution. 4. CVE-2025-5265: Potential Local Code Execution in "Copy as cURL" Command - Reporter: Amazon Basics M K - Impact: Medium - Description: Due to insufficient escaping of critical characters in the "Copy as cURL" feature, attackers may trick users into using this command, leading to local code execution. This vulnerability affects only the Windows version of Firefox. 5. CVE-2025-5266: Script Element Events Leak Cross-Origin Resource Status - Reporter: Jakub Szymański - Impact: Medium - Description: Load and error events generated by script elements loading cross-origin resources leak information, potentially enabling XSS-based leakage attacks. 6. CVE-2025-5267: Clickjacking Vulnerability May Lead to Exposure of Saved Payment Card Details - Reporter: Amazon Basics M K - Impact: Low - Description: A clickjacking vulnerability may be exploited to trick users into revealing saved payment card details to malicious pages. 7. CVE-2025-5268: Memory Safety Vulnerabilities in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 - Reporter: Mozilla Fuzzing Team, Masayuki Nakano - Impact: Medium - Description: Memory safety vulnerabilities exist, showing evidence of memory corruption; some may be exploitable to execute arbitrary code. 8. CVE-2025-5269: Memory Safety Vulnerabilities in Firefox ESR 128.11 and Thunderbird 128.11 - Reporter: Rendel Jesup - Impact: Medium - Description: Memory safety vulnerabilities show evidence of memory corruption; potentially exploitable to execute arbitrary code.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Thunderbird 128.11 Security Update: Fixes CVE-2025-5262 to 5269 including RCE and Memory Corruption