CVE-2025-11721CWE-119

CVE-2025-11721

Critical · published October 14, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

🔥 A memory safety bug in Firefox 143 and Thunderbird 143 could lead to arbitrary code execution — a potentially devastating breach just waiting to be exploited! Think of it like a faulty electrical socket that could short-circuit your entire home if a rogue plug finds its way in. This bug leaves the door open for attackers to unleash chaos within the system, just like that socket could light up your living room unexpectedly! An attacker could exploit this vulnerability to execute malicious code, posing a significant threat to user data and privacy. Worst case? They could take control of the application, leading to data breaches or worse! As this bug targets popular applications, the risk is alarmingly high.

Put simply

Think of it like a faulty electrical socket that could short-circuit your entire home if a rogue plug finds its way in. This bug leaves the door open for attackers to unleash chaos within the system, just like that socket could light up your living room unexpectedly! This memory safety vulnerability manifests as memory corruption in Firefox and Thunderbird, indicating that after sufficient effort, attackers might be able to leverage this flaw to run arbitrary code on affected systems.

What to do

An attacker could exploit this vulnerability to execute malicious code, posing a significant threat to user data and privacy. Worst case? They could take control of the application, leading to data breaches or worse! As this bug targets popular applications, the risk is alarmingly high. Upgrade to Firefox 144 and Thunderbird 144 immediately to patch this critical vulnerability. Regularly check for updates to ensure you are protected from potential risks in the future. You've got this! Following these steps will help you secure your applications and keep the internet a safer place. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2025-10-14T17:15Z
Affected products (2)
ProductVersionsFixed in
mozilla/firefox≥ 143.0, < 144.0144.0
mozilla/thunderbird≥ 143.0, < 144.0144.0
References (3)
EPSS history
Timeline
  • 14 OCT 12:27Z
    Memory safety bug fixed in Firefox 144 and Thunderbird 144
    cvelistv5