CVE-2025-1932: Mozilla Firefox Buffer Overflow Vulnerability

CVE-2025-1932 Overview

CVE-2025-1932 is an out-of-bounds access vulnerability in the xslt/txNodeSorter component shared by Mozilla Firefox and Thunderbird. An inconsistent comparator used during XSLT node sorting can drive the sort algorithm to read or write past allocated buffer boundaries. The flaw affects Firefox 122 and later releases and was corrected in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. A remote attacker can trigger the condition by serving a crafted XSLT document to a victim browser or mail client. Mozilla classifies the issue under [CWE-125] (Out-of-bounds Read).

Critical Impact
A remote attacker can serve a malicious XSLT payload that causes out-of-bounds memory access in Firefox or Thunderbird, leading to potential code execution or process crash.

Affected Products

Mozilla Firefox versions 122 through 135
Mozilla Firefox ESR versions prior to 128.8
Mozilla Thunderbird versions prior to 136 and Thunderbird ESR prior to 128.8

Discovery Timeline

2025-03-04 - CVE-2025-1932 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-1932

Vulnerability Analysis

The vulnerability lives in txNodeSorter, the XSLT helper that orders nodes produced by <xsl:sort> instructions. The sorter relies on a comparator function that must return a strict weak ordering across all inputs. Mozilla determined the comparator is inconsistent, meaning it can return contradictory results for the same pair of nodes depending on call order. Sort algorithms that depend on transitive ordering can then walk outside the bounds of the underlying node array. The result is an out-of-bounds read or write inside the browser content process. Mozilla rates the issue as exploitable, indicating the corruption is controllable enough to drive further memory disclosure or code execution chains.

Root Cause

The comparator passed to the XSLT sort routine does not enforce strict weak ordering. When the standard sort encounters inconsistent comparison results, it can index beyond the end of the working array. CWE-125 (Out-of-bounds Read) captures the immediate primitive, although Mozilla notes the access may be exploitable beyond simple disclosure.

Attack Vector

Exploitation requires user interaction. A victim must load a web page in Firefox or render HTML mail content in Thunderbird that references a crafted XSLT stylesheet. The malicious stylesheet supplies sort keys engineered to surface the comparator inconsistency. No authentication is required and the attack travels over the network through any vector that can deliver HTML or XML content to the target.

No public proof-of-concept code is available. Refer to the Mozilla Bug Report #1944313 for upstream technical detail.

Detection Methods for CVE-2025-1932

Indicators of Compromise

Unexpected crashes of firefox.exe, thunderbird.exe, or the corresponding content child processes with access violation signatures when handling XSLT content
Browser or mail client telemetry showing repeated loads of pages containing <xsl:sort> directives followed by renderer termination
Outbound connections from Firefox or Thunderbird processes immediately after rendering an XML or XSLT document from an untrusted origin

Detection Strategies

Inventory installed Firefox, Firefox ESR, and Thunderbird versions and flag any host running a build earlier than the fixed releases (136, ESR 128.8)
Inspect web proxy and email gateway logs for inbound text/xsl or application/xslt+xml content from low-reputation origins
Correlate browser crash reports with subsequent process creation or persistence events that may indicate post-exploitation activity

Monitoring Recommendations

Enable browser crash reporting and forward dumps to a central analysis pipeline for triage
Monitor endpoint EDR telemetry for child process spawns from firefox.exe or thunderbird.exe that do not match normal update or helper behavior
Track DNS and HTTP requests originating from browser processes for connections to attacker-controlled domains shortly after document rendering

How to Mitigate CVE-2025-1932

Immediate Actions Required

Upgrade Firefox to version 136 or later on all managed workstations
Upgrade Firefox ESR to 128.8 or later on enterprise deployments
Upgrade Thunderbird to 136 or Thunderbird ESR to 128.8 across all mail clients
Apply distribution updates such as the Debian LTS Announcement March 2025 on Linux fleets

Patch Information

Mozilla shipped fixes in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. Patch details are published in Mozilla Security Advisory MFSA-2025-14, MFSA-2025-16, MFSA-2025-17, and MFSA-2025-18.

Workarounds

Block inbound text/xsl and application/xslt+xml MIME types at the web proxy until patching is complete
Disable remote content rendering in Thunderbird to prevent automatic XSLT processing in HTML email
Restrict browsing to trusted sites through enterprise group policy while updates roll out

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Force Firefox policy update through enterprise policy file
cat <<'EOF' > /etc/firefox/policies/policies.json
{
  "policies": {
    "DisableAppUpdate": false,
    "AppAutoUpdate": true
  }
}
EOF