BaseFortify

Publication date: 2025-10-14

Last updated on: 2026-04-13

Assigner: Mozilla Corporation

Description

Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-14

Last Modified

2026-04-13

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11721

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 140.0 (inc)
mozilla	firefox	From 60.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory safety bug found in Firefox 143 and Thunderbird 143. It involves memory corruption, which means that the program may improperly handle memory, potentially allowing an attacker to exploit this flaw to run arbitrary code on the affected system. It affects versions of Firefox and Thunderbird earlier than 144.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary code on your system, potentially leading to unauthorized access, data theft, or system compromise. This could affect the security and stability of your applications and data.

Mitigation Strategies

To mitigate this vulnerability, update Firefox and Thunderbird to version 144 or later, as the vulnerability affects versions prior to 144.

Hi! I’m here to help you understand CVE-2025-11721. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70