CVE-2025-14325CWE-843

CVE-2025-14325

High · published December 9, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

⚡ A tricky JIT miscompilation in the JavaScript engine is no laughing matter! This could lead to unexpected behavior in your favorite applications. 🔥 Think of the JIT compiler as a restaurant chef who misreads an order — instead of preparing the right dish, they may serve something entirely different that could ruin the meal. This miscommunication can lead to chaos in your JavaScript execution! An attacker could exploit this vulnerability to execute malicious code, potentially manipulating your applications in harmful ways. While there are no known exploits yet, the risk is high enough that it could lead to serious consequences if not addressed.

Put simply

Think of the JIT compiler as a restaurant chef who misreads an order — instead of preparing the right dish, they may serve something entirely different that could ruin the meal. This miscommunication can lead to chaos in your JavaScript execution! This vulnerability arises from a Just-In-Time (JIT) compilation error in the JavaScript engine, which can lead to improper execution of code and unexpected application behavior.

What to do

An attacker could exploit this vulnerability to execute malicious code, potentially manipulating your applications in harmful ways. While there are no known exploits yet, the risk is high enough that it could lead to serious consequences if not addressed. To mitigate this, make sure to update to Firefox version 146 or Firefox ESR 140.6, as well as Thunderbird version 146 or Thunderbird 140.6. Regularly check for updates to keep your applications secure! You’ve got this! Patch up and stay safe — the internet needs your security hero skills! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-12-09T21:17Z
Affected products (4)
ProductVersionsFixed in
mozilla/firefox< 140.6.0140.6.0
mozilla/firefox< 146.0146.0
mozilla/thunderbird< 140.6.0140.6.0
mozilla/thunderbird< 146.0146.0
References (5)
EPSS history
Timeline
  • 09 DEC 13:37Z
    JIT miscompilation in the JavaScript Engine: JIT component
    cvelistv5