CVE-2025-14321: Critical Use After Free in Firefox WebRTC

CVE-2025-14321 is a critical use after free (CVSS 9.8 in the NVD record) in the WebRTC signaling component of Firefox and Thunderbird. It is fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146 and Thunderbird 140.6. Update to one of those builds or newer.

The advisories that cover this CVE are Mozilla's MFSA 2025-92 and its companion advisories for the ESR and Thunderbird releases. The Gold entry is at the Gold page for CVE-2025-14321.

What's affected

• Products: Mozilla Firefox and Mozilla Thunderbird.
• Component: WebRTC: Signaling.
• Fixed in: Firefox 146, Firefox ESR 140.6, Thunderbird 146 and Thunderbird 140.6.
• Weakness: CWE-416 (use after free).
• Severity in the NVD record: Critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
• Mozilla's own impact rating: High (Mozilla advisory).
• CISA KEV: not listed.

How to check if you're exposed

In Firefox, open the menu, choose Help, then About Firefox. The dialog shows the version and starts an update check. In Thunderbird, use Help, then About Thunderbird. You can also run the program from a terminal with the version flag, for example firefox --version.

Compare what you see with the fixed builds above. A version lower than the fixed number on the same release line is affected. Remember that ESR is a separate line: ESR 140.5 is behind ESR 140.6, while Firefox 145 is behind Firefox 146.

For fleets, query your software inventory for Firefox and Thunderbird versions on endpoints, kiosks and shared images. Distribution packages, snap and flatpak builds, and portable copies can lag behind the vendor release, so check each source.

What to do now

1. Update Firefox and Thunderbird to a fixed build: version 146 or later, or ESR 140.6 or later.
2. If you run the older ESR 115 line, update to ESR 115.31 where it applies, and plan a move to a supported ESR line.
3. Check managed images, VDI templates and portable installs, which often miss automatic updates.
4. If your organization defers browser updates, shorten that delay for these releases.
5. Restart the browser after updating, since the fix does not apply to running processes.
6. Record the patched versions in your asset list so you can answer the question next time.

Why it matters

A use after free means code keeps using a block of memory after the program has released it. If that memory is reused for something else, the program can behave in ways its authors did not intend, and in a browser that can open a path to running code from a web page. WebRTC signaling handles the setup of real time calls, so it is code that processes data from remote parties.

The NVD score of 9.8 reflects a worst case: network reach, no privileges and no user interaction. Mozilla's advisory rates the issue high and credits the reporter. The record does not say it is exploited, and it is not in CISA KEV. The fix is simple to apply, which makes delay hard to justify.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Mozilla Foundation Security Advisory 2025-92 (Firefox 146)
• Mozilla Foundation Security Advisory 2025-94 (Firefox ESR 140.6)
• Mozilla Foundation Security Advisory 2025-93 (Firefox ESR 115.31)
• Gold entry for CVE-2025-14321

Last reviewed: 19 October 2026.