Loading vulnerability…
Use-after-free in Mozilla WebRTC Signaling
CVE-2025-14321 is a high-severity use-after-free vulnerability in the WebRTC Signaling component used by Mozilla Firefox, Firefox ESR, and Thunderbird. The flaw involves accessing memory after it has been freed, potentially resulting in memory corruption. It was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. The specific vulnerable function and triggering sequence are not publicly detailed in the available information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability can cause memory corruption in the affected application. Arbitrary code execution is a potential consequence, but a confirmed CVE-specific code-execution outcome is not established. Sandbox escape, privilege escalation, and confidentiality impacts described for the broader update set cannot be independently attributed to this vulnerability.
If you can’t patch tonight, do this now.
Until patched, restrict access to untrusted web content and consider disabling WebRTC where feasible. These measures reduce exposure but are not established as a complete workaround for this vulnerability.
Patch, then assume compromise.
Upgrade to Firefox 146, Firefox ESR 140.6, Thunderbird 146, or Thunderbird 140.6, or a later supported release, as appropriate. For distribution-managed installations, apply the vendor's security update containing the corresponding fix.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.