CVE-2025-14861

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14861", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-12-18T00:22:11.950Z", "datePublished": "2025-12-18T14:21:14.680Z", "dateUpdated": "2026-04-13T14:30:33.420Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "146.0.1", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1."}]}], "title": "Memory safety bugs fixed in Firefox 146.0.1", "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1996570%2C1999700", "name": "Memory safety bugs fixed in Firefox 146.0.1"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-98/"}], "credits": [{"lang": "en", "value": "Andrew McCreight and the Mozilla Fuzzing Team"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:30:33.420Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-14861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-20T04:56:43.387489Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:07:29.673Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-14861", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-20T04:56:43.387489Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T15:39:20.216Z"}}], "cna": {"title": "Memory safety bugs fixed in Firefox 146.0.1", "credits": [{"lang": "en", "value": "Andrew McCreight and the Mozilla Fuzzing Team"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "unaffected", "version": "146.0.1", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1996570%2C1999700", "name": "Memory safety bugs fixed in Firefox 146.0.1"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-98/"}], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1.", "supportingMedia": [{"type": "text/html", "value": "Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:30:33.420Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14861", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:30:33.420Z", "dateReserved": "2025-12-18T00:22:11.950Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-12-18T14:21:14.680Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "*", "status": "unaffected", "version": "146.0.1", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "matchCriteriaId": "A4308430-B3C6-4451-8A1B-BDD115E81819", "versionEndExcluding": "146.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1."}, {"lang": "es", "value": "Errores de seguridad de memoria presentes en Firefox 146. Algunos de estos errores mostraron evidencia de corrupci\u00f3n de memoria y presumimos que con suficiente esfuerzo algunos de estos podr\u00edan haber sido explotados para ejecutar c\u00f3digo arbitrario. Esta vulnerabilidad afecta a Firefox menor que 146.0.1."}], "id": "CVE-2025-14861", "lastModified": "2026-10-05T15:10:00.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14861", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-20T04:56:43.387489Z", "version": "2.0.3"}}]}, "published": "2025-12-18T15:15:53.157", "references": [{"source": "security@mozilla.org", "tags": ["Broken Link"], "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1996570%2C1999700"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-98/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T17:30:54.032781+00:00", "value": {"mitigation_remediation": ["Upgrade Mozilla Firefox to version 146.0.1 or any newer release that contains the memory safety fixes.", "Ensure that all browser instances are kept current by enabling automatic updates or regularly checking for new releases.", "If an immediate upgrade is not feasible, restrict browser usage to trusted sites, disable or uninstall extensions that may interact with internal memory, and consider using a sandboxed or separate user profile for browsing external content."], "summary": {"action": "Patch", "impact": "Remote code execution via memory corruption"}, "threat_synthesis": {"affected_systems": "Affected products include Mozilla Firefox 146.x builds prior to the 146.0.1 release. Any installation of Firefox that has not been updated to 146.0.1 or later is vulnerable. The fix was applied in the 146.0.1 patch bundle, so systems running that or newer versions are not affected.", "description_and_impact": "The issue involves memory safety bugs in Mozilla Firefox 146 that can corrupt memory, with evidence that insufficiently validated data could be abused to execute arbitrary code. The vulnerability is categorized as CWE-119 \u2013 an uncontrolled memory write that can lead to arbitrary control\u2011flow hijacking. The official description notes that while not all bugs demonstrated an immediate exploit, the presence of memory corruption suggests that, with sufficient effort, an attacker might achieve remote code execution by crafting malicious content.", "risk_and_exploitability": "The CVSS score of 8.8 reflects a high severity due to the potential for arbitrary code execution, but the EPSS score of less than 1% indicates that the vulnerability is presently unlikely to see widespread exploitation. It is not listed in the CISA KEV catalog, further suggesting a low exploitation probability. Attackers would need to deliver crafted memory corruption through user\u2011controllable input\u2014such as a malicious web page or unsecured extension\u2014to trigger the vulnerability, making active exploitation both technically demanding and relatively rare."}}}}, "created": "2025-12-19T09:16:11.522860+00:00", "updated": "2026-04-20T17:45:12.949415+00:00", "vendors": ["mozilla", "mozilla$PRODUCT$firefox"]}