CVE-2025-14325: 
NixOS vulnerability analysis and mitigation

CVE-2025-14325 is a JIT miscompilation vulnerability (type confusion) in Mozilla's SpiderMonkey JavaScript Engine JIT component, affecting Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR. It was reported by researcher "zx" and disclosed on December 9, 2025, as part of Mozilla's coordinated security release. Affected versions include Firefox before 146, Firefox ESR before 140.6, Thunderbird before 146, and Thunderbird ESR before 140.6. The vulnerability carries a CVSS v3.1 base score of 7.3 (High) (Mozilla Advisory, Mozilla Advisory ESR).

The root cause is a type confusion (CWE-843) and improper code generation (CWE-94) in SpiderMonkey's JIT Inline Cache (IC) mechanism, specifically in SetPropIRGenerator::tryAttachAddSlotStub. The bug was introduced by the addition of Resizable and Growable ArrayBuffer support (shipped in Firefox 128, bug 1842773). The exploit scenario involves assigning a value to an out-of-range typed array index where the right-hand side's valueOf() method resizes the backing SharedArrayBuffer or ArrayBuffer mid-assignment: the first IC lookup sees the index as out-of-range (missing property, plans an AddSlot stub), but after valueOf() grows the buffer, the second lookup finds a TypedArrayElement — yet the code calls propertyInfo() as if it were a NativeProperty, reading the wrong union field. This can cause a crash or, more critically, allow JIT code to be emitted without a proper pre-barrier, creating a GC hazard and potential memory corruption exploitable for arbitrary code execution (Mozilla Bugzilla).

Successful exploitation can lead to memory corruption in the Firefox or Thunderbird process, potentially enabling arbitrary code execution in the context of the browser. An attacker who delivers a malicious web page or HTML email could trigger the type confusion to crash the application or, with sufficient effort, achieve code execution with the privileges of the browser process. The vulnerability affects confidentiality, integrity, and availability, with low-to-moderate impact across all three dimensions per the CVSS scoring, though the underlying memory corruption primitive could be chained with other vulnerabilities for greater impact (Mozilla Advisory, Mozilla Bugzilla).

A public technical write-up and proof-of-concept exploit walkthrough was published in March 2026 at core-jmp.org, titled "Breaking the JIT: Exploiting a SpiderMonkey Type Confusion Bug," which generated notable community discussion on Reddit's r/blueteamsec and Bluesky. The original PoC crash trigger was included in the Mozilla Bugzilla report by the external reporter "zx." The EPSS score is approximately 0.037% (very low probability of near-term exploitation in the wild), and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing. No threat actor attribution has been reported (Mozilla Bugzilla, Feedly).

1. Craft malicious JavaScript: Write a script that creates a SharedArrayBuffer (or resizable ArrayBuffer) with a small initial size but a large maxByteLength, then creates a Uint8Array view over it.
2. Trigger JIT compilation: Execute the vulnerable function repeatedly (e.g., 10–20 times) to cause SpiderMonkey's JIT to compile and optimize the assignment path, attaching an Inline Cache stub.
3. Race the IC with a buffer resize: Assign a value to an out-of-range typed array index (e.g., arr[0xffffffff + 9] = obj) where obj.valueOf() calls sab.grow(0xffffffff + 0x20), resizing the buffer mid-assignment so the previously out-of-range index becomes valid.
4. Trigger type confusion: The first IC lookup records the index as a missing native property (plans AddSlot stub); after valueOf() grows the buffer, the second lookup finds a TypedArrayElement but propertyInfo() is called as if it were a NativeProperty, reading the wrong union field.
5. Achieve crash or memory corruption: In a debug build, this triggers an assertion failure and crash. In a release build, the JIT emits code without a proper GC pre-barrier, creating a memory corruption primitive that can be further developed into arbitrary code execution (Mozilla Bugzilla, JIT Exploit Write-up).

• Process: Firefox or Thunderbird process crashing unexpectedly, particularly with stack traces referencing js::PropertyResult::propertyInfo(), js::jit::SetPropIRGenerator::tryAttachAddSlotStub, or js::jit::DoSetPropFallback in crash dumps.
• Logs: Application crash reports or minidumps containing references to PropertyResult.h, CacheIR.cpp, or BaselineIC.cpp in the SpiderMonkey JIT component.
• Network: Unexpected outbound connections from the Firefox or Thunderbird process following JavaScript execution from an untrusted page or email, which may indicate post-exploitation activity.
• File System: Unexpected files written by the Firefox or Thunderbird process to user-writable directories, or new processes spawned as children of the browser process.

Mozilla has released patched versions: Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users and administrators should update to these versions immediately. No configuration-based workaround is available; upgrading is the only effective remediation. Enterprise deployments should prioritize ESR channel updates. Linux distribution vendors (Red Hat, Debian, SUSE, Oracle, Rocky Linux, AlmaLinux, Amazon Linux) have also released updated packages (Mozilla Advisory, Mozilla Advisory ESR).

The vulnerability received a security bounty from Mozilla, confirming its significance. A detailed technical write-up published in March 2026 at core-jmp.org generated active discussion in the security community on Reddit's r/blueteamsec and Bluesky, with researchers highlighting the exploit's reliance on the Resizable/Growable ArrayBuffer feature introduced in Firefox 128. CIS published an advisory noting that multiple vulnerabilities in Mozilla products, including this one, could allow arbitrary code execution. The NCSC UK also referenced the vulnerability in a weekly threat landscape summary (Mozilla Bugzilla, JIT Exploit Write-up, CIS Advisory).