CVE-2025-14861: 
NixOS vulnerability analysis and mitigation

CVE-2025-14861 is a memory safety vulnerability in Mozilla Firefox 146 involving multiple memory corruption bugs that could potentially be exploited to execute arbitrary code. Discovered and reported by Andrew McCreight and the Mozilla Fuzzing Team, it was disclosed on December 18, 2025, affecting Firefox versions prior to 146.0.1. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), encompassing multiple memory safety bugs present in Firefox 146 that showed evidence of memory corruption (Mozilla Advisory). The bugs were identified via Mozilla's fuzzing infrastructure and tracked under Bugzilla bug IDs 1996570 and 1999700. Exploitation requires user interaction — such as visiting a malicious web page — but no privileges are required, and the attack can be conducted remotely over a network with low complexity. Mozilla assessed that with sufficient effort, these bugs could be leveraged to achieve arbitrary code execution (Mozilla Advisory).

Successful exploitation of CVE-2025-14861 could allow a remote attacker to execute arbitrary code on a victim's system, resulting in high impact to confidentiality, integrity, and availability. An attacker could potentially steal sensitive data, modify system contents, install malware, or disrupt browser operations. The vulnerability affects all Firefox installations running version 146 prior to 146.0.1 on any platform (Mozilla Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Mozilla Advisory). The EPSS score is approximately 0.039%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Mozilla has released Firefox 146.0.1, which addresses CVE-2025-14861 along with CVE-2025-14860. Users should update Firefox to version 146.0.1 or later immediately (Mozilla Advisory). Enabling automatic browser updates is recommended to ensure timely patching. As a supplementary measure, organizations may restrict browsing to trusted websites and implement network-level web content filtering until the patch is applied.

The vulnerability was noted in security community aggregators and vulnerability tracking platforms shortly after disclosure on December 18, 2025. Red Hat published a corresponding CVE entry, and Tenable released Nessus detection plugins (IDs 279149 and 279424) for the vulnerability. Community discussion was limited, consistent with the absence of active exploitation or public PoC code.