Skip to main content

Thunderbird CVE-2025-14329

HIGH
2025-12-09 security@mozilla.org
Privilege Escalation Mozilla Thunderbird
8.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Deliver malicious webpage or email
  2. Delivery
    User opens content and activates Netmonitor
  3. Exploit
    Trigger privilege escalation flaw
  4. Execution
    Execute arbitrary code
  5. Persist
    Bypass sandbox restrictions
  6. Impact
    Compromise confidentiality, integrity, and availability

Vulnerability Assessment

Impact

This vulnerability presents a mixed risk profile requiring careful signal analysis. The CVSS 8.8 score is high due to the network attack vector (AV:N), low complexity (AC:L), no authentication requirement (PR:N), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). However, the mandatory user interaction (UI:R) and unchanged scope (S:U) constrain real-world exploitability. The EPSS score of 0.07% at the 22nd percentile indicates current threat intelligence shows minimal active exploitation attempts. No CISA KEV listing confirms this is not observed as actively exploited in the wild. No public proof-of-concept code has been identified. From an SSVC perspective: exploitation status is none (reducing priority), not automatable due to UI requirement (reducing priority), but technical impact is total (increasing priority). The combination of high CVSS but low EPSS, no active exploitation, and user interaction requirement suggests this is a significant security concern requiring timely patching during normal maintenance windows, but not an emergency requiring immediate out-of-band deployment unless the organization's threat model includes targeted attacks against Firefox/Thunderbird users.
Exploit ScenarioDerived

An attacker crafts a malicious webpage or email containing specially crafted content that targets the Netmonitor component vulnerability. When a Firefox or Thunderbird user visits the malicious page or opens the email and interacts with the content (such as opening developer tools or triggering network monitoring functionality), the vulnerability is exploited to escalate privileges beyond the browser's sandbox, potentially allowing arbitrary code execution with the user's system privileges and access to sensitive data across browser sessions.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 13, 2026

Privilege escalation in Mozilla Firefox and Thunderbird Netmonitor component allows remote attackers to execute arbitrary code with elevated privileges when users interact with malicious content. Affects Firefox versions prior to 146, Firefox ESR prior to 140.6, Thunderbird prior to 146, and Thunderbird ESR prior to 140.6. Mozilla released patches in January 2025 across all product lines. EPSS score of 0.07% (22nd percentile) indicates low current exploitation probability, with no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. CVSS 8.8 reflects the high impact potential despite requiring user interaction.

RemediationAI

Immediately upgrade to the vendor-released patched versions: Firefox 146 or later for standard releases, Firefox ESR 140.6 or later for extended support deployments, Thunderbird 146 or later for standard releases, and Thunderbird ESR 140.6 or later for extended support email client deployments. Mozilla published patches across all affected product lines simultaneously to address this vulnerability. Organizations should deploy updates through their standard software distribution mechanisms, with priority given to internet-facing systems and users with elevated risk profiles. Complete remediation guidance is available in Mozilla Foundation Security Advisories at https://www.mozilla.org/security/advisories/mfsa2025-92/, https://www.mozilla.org/security/advisories/mfsa2025-94/, https://www.mozilla.org/security/advisories/mfsa2025-95/, and https://www.mozilla.org/security/advisories/mfsa2025-96/. The vulnerability tracking bug at https://bugzilla.mozilla.org/show_bug.cgi?id=1997018 may contain additional technical details for security teams requiring deeper analysis.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Netmonitor component is a developer tool integrated into Firefox and Thunderbird browsers that captures and analyzes network traffic for debugging purposes. This privilege escalation vulnerability exists within the Netmonitor implementation, allowing malicious actors to elevate privileges beyond the browser's sandbox restrictions. The CVSS vector PR:N indicates the vulnerability is exploitable without authentication, while UI:R shows user interaction is required to trigger the flaw. The vulnerability affects both the regular release channels and Extended Support Release (ESR) versions of Firefox and Thunderbird. Without specific CWE classification in the source data, the exact root cause class (such as improper input validation, type confusion, or memory corruption) cannot be definitively stated, though privilege escalation vulnerabilities in browser components typically involve breaking out of security boundaries or bypassing permission models.

Know when Thunderbird gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 6.1 MEDIUM

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Executive ViewAI

Why It Matters

CVE-2025-14329 is a high-severity privilege escalation vulnerability in Mozilla Firefox and Thunderbird affecting versions prior to 146/140.6 ESR, allowing remote code execution when users interact with malicious content. While no active exploitation has been confirmed, the high CVSS score (8.8) and wide product footprint create significant risk to organizations with substantial Firefox or Thunderbird deployments, particularly in environments where users access untrusted web content.

Business Impact: High
Compensating Controls

Vendor-released patch: Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird ESR 140.6. If immediate patching is not feasible, restrict user access to untrusted websites through web content filtering, disable JavaScript execution in email clients where operationally feasible, and enforce browser sandbox settings to limit privilege escalation impact.

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*

More in Thunderbird

View all
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.2 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
SUSE Enterprise Storage 7.1 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:23034 ADVISORY https://access.redhat.com/errata/RHSA-2025:23035 ADVISORY https://access.redhat.com/errata/RHSA-2025:23128 ADVISORY https://access.redhat.com/errata/RHSA-2025:23856 ADVISORY https://access.redhat.com/errata/RHSA-2026:0003 ADVISORY https://access.redhat.com/errata/RHSA-2026:0004 ADVISORY https://access.redhat.com/errata/RHSA-2026:0005 ADVISORY https://access.redhat.com/errata/RHSA-2026:0006 ADVISORY https://access.redhat.com/errata/RHSA-2026:0007 ADVISORY https://access.redhat.com/errata/RHSA-2026:0013 ADVISORY https://access.redhat.com/errata/RHSA-2026:0014 ADVISORY https://access.redhat.com/errata/RHSA-2026:0015 ADVISORY https://access.redhat.com/errata/RHSA-2026:0016 ADVISORY https://access.redhat.com/errata/RHSA-2026:0017 ADVISORY https://access.redhat.com/errata/RHSA-2026:0018 ADVISORY https://access.redhat.com/errata/RHSA-2026:0019 ADVISORY https://access.redhat.com/errata/RHSA-2026:0020 ADVISORY https://access.redhat.com/errata/RHSA-2026:0021 ADVISORY https://access.redhat.com/errata/RHSA-2026:0022 ADVISORY https://access.redhat.com/errata/RHSA-2026:0023 ADVISORY https://access.redhat.com/errata/RHSA-2026:0024 ADVISORY https://access.redhat.com/errata/RHSA-2026:0025 ADVISORY https://access.redhat.com/errata/RHSA-2026:0026 ADVISORY https://access.redhat.com/errata/RHSA-2026:0124 ADVISORY https://access.redhat.com/errata/RHSA-2026:0127 ADVISORY https://vuldb.com/vuln/335148 ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-92/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-94/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-95/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-96/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4396/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4397/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4424/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20031/ REF https://bugzilla.mozilla.org/show_bug.cgi?id=1997018

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy