CVE-2025-14326 is a critical use after free (CVSS 9.8 in the NVD record) in the Audio/Video GMP component of Firefox and Thunderbird. It is fixed in Firefox 146 and Thunderbird 146. Mozilla rates it moderate. Update to version 146 or later.
The advisories that cover this CVE are Mozilla's MFSA 2025-92 and its companion advisories for the ESR and Thunderbird releases. The Gold entry is at the Gold page for CVE-2025-14326.
What's affected
- Products: Mozilla Firefox and Mozilla Thunderbird.
- Component: Audio/Video: GMP.
- Fixed in: Firefox 146 and Thunderbird 146. The advisory does not list an ESR build for this one.
- Weakness: CWE-416 (use after free).
- Severity in the NVD record: Critical, CVSS 9.8, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Mozilla's own impact rating: Moderate (Mozilla advisory).
- CISA KEV: not listed.
How to check if you're exposed
In Firefox, open the menu, choose Help, then About Firefox. The dialog shows the version and starts an update check. In Thunderbird, use Help, then About Thunderbird. You can also run the program from a terminal with the version flag, for example firefox --version.
Compare what you see with the fixed builds above. A version lower than the fixed number on the same release line is affected. Remember that ESR is a separate line: ESR 140.5 is behind ESR 140.6, while Firefox 145 is behind Firefox 146.
For fleets, query your software inventory for Firefox and Thunderbird versions on endpoints, kiosks and shared images. Distribution packages, snap and flatpak builds, and portable copies can lag behind the vendor release, so check each source.
What to do now
- Update Firefox and Thunderbird to a fixed build: version 146 or later, or ESR 140.6 or later.
- If you run the older ESR 115 line, update to ESR 115.31 where it applies, and plan a move to a supported ESR line.
- Check managed images, VDI templates and portable installs, which often miss automatic updates.
- If your organization defers browser updates, shorten that delay for these releases.
- Restart the browser after updating, since the fix does not apply to running processes.
- Record the patched versions in your asset list so you can answer the question next time.
Why it matters
GMP stands for Gecko Media Plugins, the interface Firefox uses to run media decoders in a separate process. A use after free in that code means memory is reused after release. The separate process limits what a single bug can reach, which may be why Mozilla rates the issue moderate while the NVD score is 9.8.
Both ratings are worth knowing. NVD scores the worst case from the bug class, and Mozilla rates the real impact given its sandbox design. The practical answer is the same: update to version 146. The record does not state exploitation and the CVE is not in CISA KEV.
Quick check
Why does Mozilla say moderate when NVD says critical?
The NVD score is a worst case from the bug type. Mozilla's rating reflects its own assessment of impact. Update either way.
Is there an ESR fix?
The advisories list Firefox 146 and Thunderbird 146 only for this CVE.
Sources
- Mozilla Foundation Security Advisory 2025-92 (Firefox 146)
- Mozilla Foundation Security Advisory 2025-94 (Firefox ESR 140.6)
- Mozilla Foundation Security Advisory 2025-93 (Firefox ESR 115.31)
- Gold entry for CVE-2025-14326
Last reviewed: 19 October 2026.
