CVE-2025-14860CWE-416

CVE-2025-14860

Critical · published December 18, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

🔥 A sneaky use-after-free vulnerability lurks in the Disability Access APIs of Firefox — it’s like a faulty safety harness that lets you slip through just when you thought you were secure! Picture a bridge that suddenly forgets how to hold up its support beams, leaving anyone crossing in a precarious situation. This is what happens when memory is mishandled, creating opportunities for attackers to exploit the system. An attacker could potentially manipulate the memory in a way that leads to unauthorized access or even execute harmful code, compromising user data or system integrity. It’s like giving someone the keys to your castle just when you thought your gates were locked tight!

Put simply

Picture a bridge that suddenly forgets how to hold up its support beams, leaving anyone crossing in a precarious situation. This is what happens when memory is mishandled, creating opportunities for attackers to exploit the system. This vulnerability arises from a use-after-free situation in the Disability Access APIs, where the application fails to properly manage memory, potentially allowing an attacker to exploit this flaw with crafted inputs.

What to do

An attacker could potentially manipulate the memory in a way that leads to unauthorized access or even execute harmful code, compromising user data or system integrity. It’s like giving someone the keys to your castle just when you thought your gates were locked tight! To mitigate this risk, immediately update Firefox to version 146.0.1 to close this vulnerability and ensure memory handling is secure. It's essential to regularly check for updates and apply them promptly to maintain robust security. You've got this! By following these steps, you'll be a security hero in no time! 🦸

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00315 · 23.2th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-18T20:15Z
Affected products (1)
ProductVersionsFixed in
mozilla/firefox< 146.0.1146.0.1
References (2)
EPSS history
Timeline
  • 18 DEC 14:21Z
    Use-after-free in the Disability Access APIs component
    cvelistv5