CVE-2025-14324 is a critical JIT miscompilation bug (CVSS 9.8 in the NVD record) in the JavaScript engine of Firefox and Thunderbird. It is fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146 and Thunderbird 140.6. Update to a fixed build.
The advisories that cover this CVE are Mozilla's MFSA 2025-92 and its companion advisories for the ESR and Thunderbird releases. The Gold entry is at the Gold page for CVE-2025-14324.
What's affected
- Products: Mozilla Firefox and Mozilla Thunderbird.
- Component: JavaScript Engine: JIT.
- Fixed in: Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146 and Thunderbird 140.6.
- Weakness: CWE-94 (code injection).
- Severity in the NVD record: Critical, CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Mozilla's own impact rating: High (Mozilla advisory).
- CISA KEV: not listed.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox. The dialog shows the version and starts an update check. In Thunderbird, use Help, then About Thunderbird. You can also run the program from a terminal with the version flag, for example firefox --version.
Compare what you see with the fixed builds above. A version lower than the fixed number on the same release line is affected. Remember that ESR is a separate line: ESR 140.5 is behind ESR 140.6, while Firefox 145 is behind Firefox 146.
For fleets, query your software inventory for Firefox and Thunderbird versions on endpoints, kiosks and shared images. Distribution packages, snap and flatpak builds, and portable copies can lag behind the vendor release, so check each source.
What to do now
- Update Firefox and Thunderbird to a fixed build: version 146 or later, or ESR 140.6 or later.
- If you run the older ESR 115 line, update to ESR 115.31 where it applies, and plan a move to a supported ESR line.
- Check managed images, VDI templates and portable installs, which often miss automatic updates.
- If your organization defers browser updates, shorten that delay for these releases.
- Restart the browser after updating, since the fix does not apply to running processes.
- Record the patched versions in your asset list so you can answer the question next time.
Why it matters
A JIT compiler turns hot JavaScript into machine code at run time to make pages fast. A miscompilation means the generated code does not match what the source meant, for instance by skipping a check the program relied on. Bugs of this class are useful to attackers because they can corrupt memory from inside a web page.
The record scores this 9.8 and files it under code injection. Mozilla rates the issue high and fixed it in several release lines, including the older ESR 115 branch, which shows how long that line is still supported for security fixes. It is not in CISA KEV and the record does not state exploitation. Update all lines you run, not just the current release.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the old ESR 115 line get a fix?
Yes. The record lists Firefox ESR 115.31 as a fixed build alongside Firefox 146 and ESR 140.6.
Does this affect Thunderbird?
Yes. Thunderbird 146 and Thunderbird 140.6 contain the fix.
Sources
- Mozilla Foundation Security Advisory 2025-92 (Firefox 146)
- Mozilla Foundation Security Advisory 2025-94 (Firefox ESR 140.6)
- Mozilla Foundation Security Advisory 2025-93 (Firefox ESR 115.31)
- Gold entry for CVE-2025-14324
Last reviewed: 19 October 2026.
