CVE-2025-14329

CVE-2025-14329

High · published December 9, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

⚡ A sneaky privilege escalation flaw lurks in the Netmonitor component, waiting for your attention! Think of it like an unauthorized guest slipping backstage at a concert — they gain access to restricted areas where they can mess with the show behind the scenes! 🎤 If exploited, this vulnerability could allow an attacker to elevate their privileges, potentially giving them control over sensitive settings and data. This means they could hijack the system like a rogue performer taking over the mic, leading to chaos in your environment!

Put simply

Think of it like an unauthorized guest slipping backstage at a concert — they gain access to restricted areas where they can mess with the show behind the scenes! 🎤 This vulnerability allows users to gain elevated privileges through the Netmonitor component, enabling unauthorized access to restricted functionalities within Firefox and Thunderbird.

What to do

If exploited, this vulnerability could allow an attacker to elevate their privileges, potentially giving them control over sensitive settings and data. This means they could hijack the system like a rogue performer taking over the mic, leading to chaos in your environment! To protect yourself, update to Firefox 146, Firefox ESR 140.6, Thunderbird 146, or Thunderbird 140.6. Regularly check for updates and ensure your software is always running the latest versions! You've got this! With these updates, you’ll be locking down your systems in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00402 · 33.3th percentile
Published
2025-12-09T21:17Z
Affected products (4)
ProductVersionsFixed in
mozilla/firefox< 140.6.0140.6.0
mozilla/firefox< 146.0146.0
mozilla/thunderbird< 140.6.0140.6.0
mozilla/thunderbird< 146.0146.0
References (5)
EPSS history
Timeline
  • 09 DEC 13:38Z
    Privilege escalation in the Netmonitor component
    cvelistv5