CVE-2025-14321: 
NixOS vulnerability analysis and mitigation

CVE-2025-14321 is a use-after-free (UAF) vulnerability in the WebRTC: Signaling component (RTCEncodedFrameBase) of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. Discovered and reported by Igor Morgenstern of Aisle Research, it was publicly disclosed on December 9, 2025. Affected versions include Firefox before 146, Firefox ESR before 140.6, Thunderbird before 146, and Thunderbird ESR before 140.6; Firefox ESR 115.x is unaffected. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory mfsa2025-92, Mozilla Advisory mfsa2025-94, Oracle Bulletin).

The root cause (CWE-416: Use After Free) lies in RTCEncodedFrameBase, which wraps a libwebrtc frame buffer using JS::NewArrayBufferWithUserOwnedContents but fails to detach the JavaScript ArrayBuffer in its destructor. This means the JS ArrayBuffer continues to alias native memory that has already been freed when the RTCEncodedFrameBase object is destroyed. An attacker can exploit this from web content — without any privileges or user interaction — by creating RTCPeerConnection objects, collecting frame data ArrayBuffers in a worker, dropping the frame wrappers to trigger the destructor, and then reading or writing the dangling buffer to leak heap contents or corrupt reused allocations. A proof-of-concept (poc-minimal.html + poc-minimal-worker.js) was submitted with the original bug report and demonstrated a crash with a non-canonical address (0x4141414141414159) confirming memory corruption (Mozilla Bugzilla).

Successful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution within the browser process, with full confidentiality, integrity, and availability impact on the affected system. Reads from the dangling ArrayBuffer can leak stale heap contents (data theft), while writes can corrupt reused allocations, enabling process crashes or code execution. Because the vulnerability is exploitable from web content without user interaction, any user visiting a malicious webpage with a vulnerable browser version is at risk, and Android is also affected (Mozilla Bugzilla, Mozilla Advisory mfsa2025-92).

A public proof-of-concept exploit was published on GitHub (https://github.com/h3raklez/CVE-2025-14321) as of March 2, 2026, and the original PoC HTML/JS files were attached to the Mozilla bug report by the discoverer (Mozilla Bugzilla). There is no confirmed evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.017% (very low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The availability of public PoC code increases the likelihood of future exploitation attempts (Feedly).

1. Reconnaissance: Identify targets running vulnerable versions of Firefox (< 146 or ESR < 140.6) or Thunderbird (< 146 or ESR < 140.6) using passive fingerprinting or user-agent analysis.
2. Host malicious page: Set up a web server hosting a crafted HTML page and a companion Web Worker JavaScript file designed to exploit the WebRTC Encoded Transforms API.
3. Establish RTCPeerConnection: The malicious page creates two RTCPeerConnection objects with a canvas video track (no camera/microphone permissions required) and sets up an encoded transform pipeline to intercept RTCEncodedVideoFrame objects.
4. Collect dangling ArrayBuffers: A Web Worker collects up to ~200 frame.data ArrayBuffers from intercepted frames, then drops references to the frame wrapper objects, triggering RTCEncodedFrameBase destructors and freeing the underlying native memory while the JS ArrayBuffers still alias it.
5. Trigger memory corruption: The worker overwrites all collected (now-dangling) ArrayBuffers with a controlled byte pattern (e.g., 0x41). On subsequent frames, the worker monitors for changes, confirming memory reuse and enabling read/write primitives over freed heap memory.
6. Achieve code execution: Leverage the read/write primitive to perform heap grooming, overwrite function pointers or vtable entries, and redirect execution to attacker-controlled shellcode or a ROP chain for full process compromise (Mozilla Bugzilla).

• Network: Unexpected outbound connections from the browser process to unknown external IPs following WebRTC session establishment; WebRTC ICE negotiation traffic initiated without user-visible video/audio calls.
• Process: Browser child process (content process) spawning unexpected child processes (e.g., sh, cmd.exe, curl, wget, powershell) — indicative of post-exploitation activity.
• Logs: Browser crash reports or minidumps referencing RTCEncodedFrameBase, DelayedRunnable::Notify, or non-canonical memory addresses (e.g., 0x4141414141414159) in stack traces; SIGSEGV crashes in WebRTC worker threads.
• File System: Unexpected files written to the browser profile directory or temporary directories by the browser process; new scheduled tasks or persistence mechanisms created under the browser service account.

Mozilla has released patched versions addressing CVE-2025-14321: Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users and administrators should update immediately to one of these versions. No configuration-based workaround is available; upgrading is the only remediation. Organizations should enable automatic browser updates where possible, and enterprise administrators should prioritize deployment via their software management tooling. Oracle Solaris users should apply the patches referenced in the January 2026 Oracle Solaris Third Party Bulletin (Mozilla Advisory mfsa2025-92, Mozilla Advisory mfsa2025-94, Oracle Bulletin).

The vulnerability was awarded a Mozilla security bug bounty (sec-bounty+), reflecting its significance (Mozilla Bugzilla). The CIS published an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2025-14321, could allow arbitrary code execution. The vulnerability appeared in community CVE trending lists on Reddit (r/CVEWatch) in early February 2026 following the publication of the GitHub PoC. A detailed technical write-up was published by Aisle Research (the discoverer's organization) explaining the encoded transforms UAF mechanism (Aisle Research Blog).