Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144 and Thunderbird 144.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1986816 | Issue Tracking Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2025-81/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2025-84/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144 and Thunderbird 144. |
15 Oct 2025, 18:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1986816 - Issue Tracking, Permissions Required | |
| References | () https://www.mozilla.org/security/advisories/mfsa2025-81/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2025-84/ - Vendor Advisory | |
| First Time |
Mozilla
Mozilla firefox Mozilla thunderbird |
|
| CPE | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
15 Oct 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-119 |
14 Oct 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-14 13:15
Updated : 2026-04-13 15:16
NVD link : CVE-2025-11721
Mitre link : CVE-2025-11721
CVE.ORG link : CVE-2025-11721
JSON object : View
Products Affected
mozilla
- firefox
- thunderbird
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer