CVE-2025-14322

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14322", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-12-09T13:37:54.554Z", "datePublished": "2025-12-09T13:37:55.159Z", "dateUpdated": "2026-04-13T14:25:29.901Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "115.31", "lessThanOrEqual": "115.*", "versionType": "rpm"}, {"status": "unaffected", "version": "140.6", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "146", "lessThanOrEqual": "*", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "140.6", "lessThanOrEqual": "140.*", "versionType": "rpm"}, {"status": "unaffected", "version": "146", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]}], "title": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1996473"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-93/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"}], "credits": [{"lang": "en", "value": "Oskar L"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:25:29.901Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-14322", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-10T04:57:18.096368Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:57:08.711Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-14322", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-10T04:57:18.096368Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T15:37:07.838Z"}}], "cna": {"title": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component", "credits": [{"lang": "en", "value": "Oskar L"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "115.31", "versionType": "rpm", "lessThanOrEqual": "115.*"}, {"status": "unaffected", "version": "140.6", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "146", "versionType": "rpm", "lessThanOrEqual": "*"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "140.6", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "146", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1996473"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-93/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"}], "descriptions": [{"lang": "en", "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.", "supportingMedia": [{"type": "text/html", "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:25:29.901Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14322", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:25:29.901Z", "dateReserved": "2025-12-09T13:37:54.554Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-12-09T13:37:55.159Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "115.*", "status": "unaffected", "version": "115.31", "versionType": "rpm"}, {"lessThanOrEqual": "140.*", "status": "unaffected", "version": "140.6", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "146", "versionType": "rpm"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "140.*", "status": "unaffected", "version": "140.6", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "146", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "22C1C512-2D57-4BCB-ABE2-5CA41F354AA1", "versionEndExcluding": "115.31.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "matchCriteriaId": "3EF4CBBC-DCB5-4540-8B8A-91DA759ED631", "versionEndExcluding": "146.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "matchCriteriaId": "AB211B63-E6CF-4D11-BCEE-CF495FA0B0EF", "versionEndExcluding": "140.6.0", "versionStartIncluding": "116.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "matchCriteriaId": "F04F8674-52CC-4217-B94A-8C5E80C5B996", "versionEndExcluding": "140.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "matchCriteriaId": "1CB46BC7-512D-45BF-BCF4-73FDDF94DBAF", "versionEndExcluding": "146.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}, {"lang": "es", "value": "Escape de sandbox debido a condiciones de l\u00edmite incorrectas en el componente Graphics: CanvasWebGL. Esta vulnerabilidad afecta a Firefox menor que 146, Firefox ESR menor que 115.31, Firefox ESR menor que 140.6, Thunderbird menor que 146 y Thunderbird menor que 140.6."}], "id": "CVE-2025-14322", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.8, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14322", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-10T04:57:18.096368Z", "version": "2.0.3"}}]}, "published": "2025-12-09T16:17:39.523", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1996473"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-92/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-93/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-94/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-95/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-96/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component", "id": "2420506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420506"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-14322", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhel10/firefox-flatpak", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-09T13:37:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-14322\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14322\nhttps://www.mozilla.org/security/advisories/mfsa2025-94/#CVE-2025-14322"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-20T17:38:15.069461+00:00", "value": {"mitigation_remediation": ["Update to Firefox 146 or newer, or to the latest ESR 115.31 or 140.6, and install the corresponding patch.", "Update Thunderbird to version 146 or newer, or to the latest ESR 140.6, and apply the available fix.", "If an update cannot be applied immediately, block or disable WebGL by setting \"dom.webgl.enabled\" to false in about:config or through a policy configuration to prevent exploitation via the CanvasWebGL component."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via sandbox escape"}, "threat_synthesis": {"affected_systems": "Users of Mozilla Firefox versions before 146 (including ESR 115.x and ESR 140.x releases) and users of Mozilla Thunderbird versions before 146 (including ESR 140.x) are affected. All builds containing the CanvasWebGL component prior to the stated patch dates are vulnerable.", "description_and_impact": "The CanvasWebGL component in Mozilla\u2019s browsers and email client performs improper boundary checks, allowing a malicious actor to escape the sandbox and execute code or read local files. This defect is categorized as CWE\u2011754, an improper restriction of operations within the bounds of a resource. The consequence is the ability for an attacker to gain full remote code execution on a vulnerable system.", "risk_and_exploitability": "The vulnerability carries a high CVSS score of 8.0, reflecting significant potential impact. Its EPSS score is below 1 %, indicating a low probability of exploitation at this time, and it is not listed in the CISA KEV catalog. The likely attack vector involves loading a crafted WebGL scene from a malicious web page or an email attachment, which triggers the boundary error and causes the sandbox escape, potentially leading to arbitrary code execution."}}}}, "created": "2025-12-10T17:50:58.299459+00:00", "updated": "2026-04-20T17:45:12.953332+00:00", "vendors": ["mozilla", "mozilla$PRODUCT$firefox", "mozilla$PRODUCT$firefox_esr"]}