CVE-2025-14321 is a use-after-free vulnerability classified under CWE-416 affecting the WebRTC signaling component in Mozilla Firefox and Thunderbird. This memory safety bug could lead to arbitrary code execution if exploited. The vulnerability was addressed and fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. The CVSS 3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges or user interaction needed, and high impact on confidentiality, integrity, and availability. The Mozilla Foundation released security advisories MFSA 2025-92 and MFSA 2025-94 detailing the fix and related memory safety issues. No exploits in the wild are currently known.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code remotely without any user interaction or privileges, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability affects Firefox and Thunderbird versions prior to the fixed releases. No known active exploitation has been reported.

This vulnerability is fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation actions are required beyond applying the official updates provided by Mozilla.