CVE-2025-14326CWE-416

CVE-2025-14326

Critical · published December 9, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

🚨 A sneaky use-after-free flaw lurks in the Audio/Video GMP component of Firefox and Thunderbird! 🔥 Think of it like a movie theater giving away tickets for a show that’s already ended; once you’ve used the ticket (or the memory), it shouldn’t be valid anymore! But if that theater keeps accepting it, anyone can waltz in and take over the spotlight, leading to unexpected chaos. An attacker could potentially exploit this vulnerability to execute arbitrary code, gaining full control of your system. Imagine the devastation—malicious software could be installed, sensitive data could be compromised, and your online safety could be thrown out the window! This is a serious threat that demands immediate action.

Put simply

Think of it like a movie theater giving away tickets for a show that’s already ended; once you’ve used the ticket (or the memory), it shouldn’t be valid anymore! But if that theater keeps accepting it, anyone can waltz in and take over the spotlight, leading to unexpected chaos. This use-after-free vulnerability occurs when memory is accessed after it has been freed, allowing malicious actors to execute arbitrary code in the context of the user. This flaw resides in the Audio/Video GMP component of Firefox and Thunderbird, and it has been addressed in versions 146 of both applications.

What to do

An attacker could potentially exploit this vulnerability to execute arbitrary code, gaining full control of your system. Imagine the devastation—malicious software could be installed, sensitive data could be compromised, and your online safety could be thrown out the window! This is a serious threat that demands immediate action. To protect your system, immediately update Firefox and Thunderbird to version 146 or later. Regularly check for updates and enable automatic updates to ensure you’re always running the most secure version possible. You've got this! With these updates, you’re taking charge of your security and making the internet a safer place! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00463 · 39.1th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-09T21:17Z
Affected products (2)
ProductVersionsFixed in
mozilla/firefox< 146.0146.0
mozilla/thunderbird< 146.0146.0
References (3)
EPSS history
Timeline
  • 09 DEC 13:38Z
    Use-after-free in the Audio/Video: GMP component
    cvelistv5