CVE-2025-14321
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
AnalysisAI
Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.
Technical ContextAI
CWE-416 use-after-free vulnerabilities occur when code continues to reference memory after it has been deallocated, allowing attackers to manipulate freed memory regions for arbitrary code execution. The vulnerability resides in WebRTC (Web Real-Time Communication) signaling components, which handle peer-to-peer communication session setup and negotiation in modern browsers. WebRTC signaling processes network-provided data to establish connections, making it an attack surface accessible remotely. The affected products per CPE data include both standard and Extended Support Release (ESR) branches of Firefox (desktop browser) and Thunderbird (email/calendar client), indicating the flaw exists in shared Mozilla networking code used across their application suite.
RemediationAI
Upgrade immediately to Firefox 146 or Firefox ESR 140.6 for browser installations, and Thunderbird 146 or Thunderbird ESR 140.6 for email client installations. Mozilla has released patches across all affected product lines simultaneously. Enterprise administrators should prioritize deployment through existing update mechanisms (GPO, configuration management tools, or Mozilla's enterprise policy templates). For Firefox ESR users on long-term support channels, upgrade to version 140.6 which backports the security fix while maintaining ESR stability commitments. No workarounds are available for this memory corruption vulnerability; patching is the only effective mitigation. Download patched versions from https://www.mozilla.org or consult the security advisories at https://www.mozilla.org/security/advisories/mfsa2025-92/, mfsa2025-94/, mfsa2025-95/, and mfsa2025-96/ for version-specific guidance. Verify successful patching by navigating to About Firefox or About Thunderbird and confirming version numbers meet or exceed 146 (standard) or 140.6 (ESR).
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today