CVE-2025-14324: 
NixOS vulnerability analysis and mitigation

CVE-2025-14324 is a JIT miscompilation vulnerability in the JavaScript Engine's JIT (Just-In-Time) component of Mozilla Firefox and Thunderbird. Discovered by researcher Lingming Zhang and disclosed on December 9, 2025, the flaw affects Firefox before version 146, Firefox ESR before 115.31 and 140.6, Thunderbird before 146, and Thunderbird ESR before 140.6. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory, Mozilla Advisory ESR 140.6).

The root cause is an assertion failure in the RISC-V 64-bit JIT assembler: when the JIT compiler's AssemblerBufferWithConstantPools inserts a veneer (trampoline) to bridge a short-range branch that cannot directly reach its target, the veneer itself can be placed beyond the deadline of a second short-range branch, causing that branch's jump offset immediate to overflow (specifically, the is_intn(imm, kJumpOffsetBits) assertion at base-riscv-i.h:113). In non-debug (release) builds where the assertion is absent, the overflowed jal instruction encodes a backwards jump instead of the intended forward jump, resulting in execution of arbitrary or unintended code. The bug was introduced by the AssemblerBufferWithConstantPools implementation (regressed by Bug 1210554) and affects the RISC-V 64-bit backend; Mozilla engineers noted it could also theoretically affect ARM64 under certain conditions. A proof-of-concept JavaScript file (poc.js) was attached to the public Mozilla Bugzilla report (Mozilla Bugzilla).

Successful exploitation could allow an attacker to achieve arbitrary code execution within the context of the browser process, with high impact to confidentiality, integrity, and availability. Because the CVSS vector indicates no user interaction and no privileges required, a remote attacker could potentially trigger the miscompilation by delivering a crafted JavaScript payload to a vulnerable browser. This could lead to full compromise of the affected system, unauthorized access to sensitive data, and potential for lateral movement if the browser is running in an enterprise environment (Mozilla Advisory, Feedly).

As of the disclosure date, there is no public evidence of active in-the-wild exploitation or a weaponized exploit kit for CVE-2025-14324. A proof-of-concept JavaScript file was submitted by the reporter (Lingming Zhang) and is attached to the public Bugzilla ticket, demonstrating the crash on a RISC-V 64-bit simulator build. The EPSS score is approximately 0.018% (0.000180), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time (Mozilla Bugzilla, Feedly).

1. Identify vulnerable targets: Locate systems running Firefox (versions before 146 or ESR before 115.31/140.6) or Thunderbird (versions before 146 or ESR before 140.6), particularly on RISC-V 64-bit or potentially ARM64 platforms.
2. Craft malicious JavaScript: Develop a JavaScript payload that triggers the JIT compiler's AssemblerBufferWithConstantPools to generate a code sequence where a veneer is inserted past the deadline of a second short-range branch, causing the jump offset to overflow.
3. Deliver the payload: Host the crafted JavaScript on a malicious web page or embed it in an HTML email (for Thunderbird), then direct the victim to visit the page or open the email.
4. Trigger JIT compilation: The JavaScript engine's baseline JIT compiler processes the script; the miscompilation causes the overflowed jal instruction to jump to an unintended memory location in release builds.
5. Achieve code execution: The corrupted jump redirects execution flow to attacker-controlled or unintended code, potentially enabling arbitrary code execution within the browser process (Mozilla Bugzilla, Mozilla Advisory).

• Process: Unexpected crashes or abnormal termination of Firefox or Thunderbird processes, particularly on RISC-V 64-bit or ARM64 systems; assertion failures logged referencing base-riscv-i.h or IonAssemblerBufferWithConstantPools.h in debug builds.
• Logs: Browser crash reports or core dumps referencing js::jit::AssemblerRISCVI::SetJalOffset, PatchShortRangeBranchToVeneer, or BaselineCompile in stack traces.
• Network: Unusual outbound connections from the browser process to unknown external IPs following JavaScript execution from untrusted sources.
• File System: Unexpected files written by the browser process to non-standard directories, which may indicate post-exploitation activity.

Mozilla has released patched versions addressing CVE-2025-14324: Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users and administrators should update to these versions immediately. No configuration-based workaround is available; upgrading is the only effective remediation. Enterprise administrators should enforce browser update policies and verify software versions across all managed systems (Mozilla Advisory, Mozilla Advisory ESR 115.31, Mozilla Advisory ESR 140.6).

Mozilla rated the vulnerability as "high" impact in its official security advisories and awarded a security bounty to the reporter, Lingming Zhang. The Mozilla Bugzilla discussion reflects internal debate about severity, with the bug initially triaged as S4/P5 before being escalated to S2/P1 after engineers confirmed potential for reliable arbitrary code execution on ARM64 as well. The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Mozilla products, including this one, could allow for arbitrary code execution (CIS Advisory). Downstream Linux distributions including Red Hat, Debian, Oracle Linux, Rocky Linux, AlmaLinux, SUSE, and Slackware issued their own security updates shortly after Mozilla's disclosure.