CVE-2014-1541: Mozilla Firefox

High severity, CVSS 10.0. EPSS: 3.7% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.

Affected products

• Mozilla Firefox: up to and including 29.0.1; version 24.0 only; version 24.0.1 only; version 24.0.2 only; version 24.1.0 only; version 24.1.1 only
• Mozilla Firefox ESR: version 24.2 only; version 24.3 only; version 24.4 only; version 24.5 only
• Mozilla Thunderbird: up to and including 24.5; version 24.0 only; version 24.0.1 only; version 24.1 only; version 24.1.1 only; version 24.2 only; …

Published 2014-06-11. Last modified 2026-06-17.