Loading vulnerability…
Memory safety vulnerabilities in Mozilla Firefox and Thunderbird 145
CVE-2025-14332 covers multiple memory safety bugs in Mozilla Firefox 145 and Thunderbird 145. Some of these bugs exhibited memory corruption and were considered potentially exploitable for arbitrary code execution with sufficient effort. Specific vulnerable functions and memory corruption mechanisms are not identified. The vulnerabilities were fixed in Firefox 146 and Thunderbird 146.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could potentially execute arbitrary code in the context of the affected application. Memory corruption was observed, but successful code execution was not established. Sandbox escape, privilege escalation, and full system compromise are not established consequences of this CVE alone.
If you can’t patch tonight, do this now.
No CVE-specific temporary workaround is identified. Until updates are applied, avoid untrusted websites and exercise caution with downloads. Least-privilege operation and available anti-exploitation protections may reduce exposure or impact but do not correct the underlying memory safety defects.
Patch, then assume compromise.
Upgrade Firefox to version 146 or later and Thunderbird to version 146 or later. The explicitly identified affected releases for this CVE are Firefox 145 and Thunderbird 145; ESR applicability is not established by the CVE-specific information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.