Loading vulnerability…
CVE-2025-14321 is a use-after-free vulnerability in the WebRTC Signaling component of Mozilla Firefox and Thunderbird. The issue affects Firefox before 146, Firefox ESR before 140.6, Thunderbird before 146, and Thunderbird before 140.6. The provided content identifies the flaw specifically as a memory-lifetime error in WebRTC signaling logic, where freed memory may be subsequently accessed, creating a memory corruption condition. In the context of browser-exposed WebRTC functionality, such a flaw may be reachable through attacker-controlled web content or other content that exercises the vulnerable signaling code paths.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a single functional browser PoC (poc-cve-2025-14321.html) plus a detailed README. The PoC targets CVE-2025-14321, a Firefox WebRTC Encoded Transforms Use-After-Free in RTCEncodedFrameBase where native frame backing memory is freed without detaching the JS ArrayBuffer, leaving dangling pointers. The HTML/JS sets up a local WebRTC loopback using two RTCPeerConnections (pc1↔pc2), creates a predictable video source via an animated canvas captureStream(30) (optionally uses getUserMedia to improve ICE candidate generation), and attaches an RTCRtpScriptTransform worker to the sender before SDP negotiation. In the worker, it retains frame.data ArrayBuffers for ~200 frames, writes a 0x41 pattern, and intentionally does not forward frames so the native wrapper is destroyed and memory freed while JS still holds references. It then periodically reads the retained buffers to detect allocator reuse (bytes differ from 0x41) and rewrites 0x41, demonstrating UAF read/write primitives and typically causing progressive heap corruption and a tab crash on vulnerable Firefox versions. The README documents affected versions (Firefox <146, ESR <140.6), required about:config settings, how to serve the PoC over HTTP, expected logs for vulnerable vs patched builds, and references the upstream fix commit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free vulnerability in the WebRTC component of Mozilla Firefox and related products, potentially allowing arbitrary code execution.
A use-after-free vulnerability in the WebRTC: Signaling component of Firefox, which could potentially allow an attacker to execute arbitrary code or cause a crash.
A use-after-free vulnerability in the WebRTC: Signaling component of Firefox ESR, which could allow an attacker to execute arbitrary code or cause a denial of service.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.