Loading vulnerability…
Use-after-free in Mozilla Firefox and Thunderbird Audio/Video GMP
CVE-2025-14326 is a use-after-free vulnerability in the Audio/Video: GMP component of Mozilla Firefox and Thunderbird. The flaw involves accessing memory after it has been freed, potentially causing memory corruption. Mozilla rates the vulnerability as moderate impact and fixed it in Firefox 146 and Thunderbird 146. The specific vulnerable function and triggering sequence are not available.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability can result in invalid memory access and potentially application crashes or other memory-corruption effects. Arbitrary code execution, information disclosure, privilege escalation, and sandbox escape have not been established specifically for this CVE.
If you can’t patch tonight, do this now.
Until Firefox is updated, avoid untrusted websites as a precaution. No vulnerability-specific temporary workaround is identified; this precaution does not replace installing the fixed release.
Patch, then assume compromise.
Upgrade Firefox to version 146 or later and Thunderbird to version 146 or later. Fixed ESR versions for this specific vulnerability are not established by the available information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.