CVE-2025-14325

The flaw is a miscompilation bug in the JavaScript engine’s JIT component, leading to incorrect machine code generation. Based on the nature of JIT miscompilation, the vulnerability could permit execution of arbitrary native code, but this impact is inferred from the description. The weakness relates to CWE‑843 (data conversion errors) and CWE‑94 (code injection).

Mozilla products are affected, specifically Firefox and Thunderbird, including their ESR branches. Versions before Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6 are vulnerable.

The CVSS score of 7.3 indicates high severity, while the EPSS score of less than 1 % suggests a low probability of exploitation currently. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is delivery of malicious JavaScript through a web page or webmail interface, inferred from the vulnerability affecting a JavaScript engine. Exploitation would require the attacker to supply crafted JavaScript to the victim’s machine, which may be achieved via compromised websites or phishing emails. No public exploit is available, and the low EPSS score mitigates immediate threat, but the high severity warrants prompt remediation.