CVE-2025-14326: 
NixOS vulnerability analysis and mitigation

CVE-2025-14326 is a use-after-free vulnerability in the Audio/Video: GMP (Gecko Media Plugin) component of Mozilla Firefox and Thunderbird. It affects Firefox and Thunderbird versions prior to 146.0 and was discovered and reported by Mozilla developer Andrew McCreight. The vulnerability was publicly disclosed on December 9, 2025, when Mozilla released security advisories MFSA2025-92 and MFSA2025-95. Mozilla rates the impact as moderate, though third-party sources assign a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-416 (Use After Free) and originates in the MediaDrmCDMProxy::Shutdown() method within the Gecko Media Plugin framework, which handles EME (Encrypted Media Extensions) and DRM-related media playback (Mozilla Bugzilla). During shutdown, a nested event loop is spun inside MediaDrmCDMProxy::Shutdown(), and callbacks such as MediaDrmCDMCallbackProxy::SessionClosed can fire and access mKeys — a data member that has already been freed — resulting in a SIGSEGV crash on a poison value. The crash manifests in functions including mozilla::CDMProxy::MainThreadOnlyRawPtr<T>::IsNull, MediaDrmCDMCallbackProxy::ResolvePromise, SessionClosed, and SetSessionId. The bug was observed primarily on Android and was present across many Firefox versions (from at least Firefox 117 through 145) before being fixed. The fix involved adding stronger stack references in MediaKeys::Shutdown() to prevent premature deallocation (Mozilla Bugzilla).

Successful exploitation could theoretically allow an attacker to execute arbitrary code, compromise system integrity, or cause a denial of service via application crash, with high impacts on confidentiality, integrity, and availability per the CVSS scoring (Red Hat Bugzilla). In practice, Mozilla assessed the vulnerability as moderate severity, noting that the crash is associated with browser/media shutdown sequences and is therefore considered harder to exploit reliably (Mozilla Bugzilla). The vulnerability was observed almost exclusively on Android devices. For Thunderbird, the risk is further reduced because scripting is disabled when reading mail, limiting exposure to browser-like contexts (Mozilla Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is very low at approximately 0.018%, reflecting the low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Mozilla's own assessment notes that constructing a reliable exploit would not be straightforward, given the crash occurs during a specific shutdown sequence and has historically been rare (occurring roughly once or twice per Firefox release version) (Mozilla Bugzilla).

Mozilla has released fixes in Firefox 146 and Thunderbird 146, which should be applied immediately (Mozilla Advisory, Mozilla Advisory). No configuration-based workaround is available; upgrading to the patched version is the only recommended remediation. Organizations managing Firefox or Thunderbird deployments should verify patch application across all endpoints, particularly Android devices where the crash has been observed. Disabling or restricting browser media plugins (GMP/EME) where not operationally required may reduce exposure as an interim measure.

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2025-14326, could allow for arbitrary code execution, recommending prompt patching (CIS Advisory). Red Hat tracked the vulnerability via its security response process and assigned it medium priority (Red Hat Bugzilla). SUSE also issued downstream advisories covering the vulnerability. No significant independent researcher commentary or social media discussion beyond automated CVE tracking posts has been observed.