CVE-2025-14333CWE-119CWE-787

CVE-2025-14333

High · published December 9, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
37.3
In the wild
Unconfirmed
What it is

⚡ Memory safety bugs are sneaky little gremlins lurking in Firefox and Thunderbird, ready for mischief! Think of these memory safety flaws as a bunch of uninvited guests at a party who might just help themselves to your stash — if you don’t kick them out soon, they could take control of the room! If left unaddressed, these vulnerabilities could allow highly skilled attackers to execute arbitrary code, potentially leading to data breaches or system compromise. Imagine an intruder taking over the DJ booth at your party, playing whatever they want instead of your carefully curated playlist!

Put simply

Think of these memory safety flaws as a bunch of uninvited guests at a party who might just help themselves to your stash — if you don’t kick them out soon, they could take control of the room! The memory safety bugs in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145, and Thunderbird 145 show signs of memory corruption, which could be exploited to run arbitrary code if enough effort is applied by the attacker.

What to do

If left unaddressed, these vulnerabilities could allow highly skilled attackers to execute arbitrary code, potentially leading to data breaches or system compromise. Imagine an intruder taking over the DJ booth at your party, playing whatever they want instead of your carefully curated playlist! Update to Firefox 146, Firefox ESR 140.6, Thunderbird 146, or Thunderbird 140.6 to close the door on these vulnerabilities. Don’t forget to regularly check for updates to keep all your applications secure! You've got this! With these updates, you're one step closer to keeping your systems safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.3th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-787 · Out-of-bounds Write
Published
2025-12-09T21:17Z
Affected products (4)
ProductVersionsFixed in
mozilla/firefox< 140.6.0140.6.0
mozilla/firefox< 146.0146.0
mozilla/thunderbird< 140.6.0140.6.0
mozilla/thunderbird< 146.0146.0
References (5)
EPSS history
Timeline
  • 09 DEC 13:38Z
    Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146
    cvelistv5