CVE-2025-11721: Memory safety bug fixed in Firefox 144 and Thunderbird 144

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-14 · updated 2026-10-18
Weakness: CWE-119

Description

Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

Affected products

Mozilla Firefox: from 143.0 before 144.0 — fixed in 144.0
Mozilla Thunderbird: from 143.0 before 144.0 — fixed in 144.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 144.0; Mozilla Thunderbird 144.0. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1986816
https://www.mozilla.org/security/advisories/mfsa2025-81/
https://www.mozilla.org/security/advisories/mfsa2025-84/

Get alerted when CVE-2025-11721 or the next vulnerability affects your stack