Loading vulnerability…
Memory corruption in Mozilla Firefox and Thunderbird
CVE-2025-14333 covers multiple memory safety bugs present in Mozilla Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird ESR 140.5. Some of these bugs exhibited memory corruption and are considered potentially exploitable for arbitrary code execution with sufficient effort. Specific vulnerable functions and memory corruption mechanisms have not been identified publicly in the available details. Fixes were released in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow arbitrary code execution within the affected application's execution context, potentially compromising the confidentiality, integrity, and availability of accessible data. Arbitrary code execution is a potential consequence of the observed memory corruption, not an established exploitation result. Sandbox escape or privilege escalation is not established for this CVE.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is specified. Until updates are deployed, restrict access to untrusted web content and avoid opening untrusted email content or attachments in affected applications. Least-privilege operation and endpoint anti-exploitation controls may reduce potential impact but do not correct the underlying memory safety bugs.
Patch, then assume compromise.
Upgrade Firefox to version 146 or later, Firefox ESR to 140.6 or later, Thunderbird to 146 or later, or Thunderbird ESR to 140.6 or later within the applicable supported release line. For distribution-managed installations, apply the corresponding vendor security updates containing these fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.