CVE-2025-14744

{"id": "CVE-2025-14744", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14744", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-18T19:12:45.595694Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Firefox for iOS", "versions": [{"status": "unaffected", "version": "144.0", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2025-12-18T15:15:52.500", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1984683", "tags": ["Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-97/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0."}, {"lang": "es", "value": "Los caracteres Unicode RTLO podr\u00edan permitir que sitios web maliciosos suplanten nombres de archivo en la interfaz de usuario de descargas de Firefox para iOS, enga\u00f1ando potencialmente a los usuarios para que guarden archivos de un tipo de archivo inesperado. Esta vulnerabilidad afecta a Firefox para iOS menor que 144.0."}], "lastModified": "2026-10-05T15:10:00.590", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "0ED73B6B-B41E-4DB1-8FEC-6550365BC33D", "versionEndExcluding": "144.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}