Memory Corruption in Firefox <146.0.1 Enables Code Execution

Publication date: 2025-12-18

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description

Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14861

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	<146.0.1>

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability involves memory safety bugs in Firefox versions before 146.0.1. Some of these bugs showed evidence of memory corruption, which means that attackers could potentially exploit them to run arbitrary code on the affected system.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system through Firefox, potentially leading to unauthorized actions, data theft, or system compromise.

Mitigation Strategies

To mitigate this vulnerability, update Firefox to version 146.0.1 or later, as the vulnerability affects Firefox versions prior to 146.0.1.

Hi! I’m here to help you understand CVE-2025-14861. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70