CVE-2025-11719
📋 TL;DR
A use-after-free vulnerability in Thunderbird's native messaging API on Windows allows memory corruption when web extensions interact with the API. This affects Firefox versions before 144 and Thunderbird versions before 144, potentially leading to crashes or arbitrary code execution.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Thunderbird by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Thunderbird/Firefox process, potentially leading to full system compromise.
Likely Case
Application crashes (denial of service) and potential memory corruption leading to information disclosure or limited code execution.
If Mitigated
Application crashes only, with no code execution due to sandboxing or exploit mitigations.
🎯 Exploit Status
Exploitation requires triggering the vulnerable API through web extensions, which may need user interaction or specific extension configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 144, Thunderbird 144
Vendor Advisory: https://www.mozilla.org/security/advisories/mfsa2025-81/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Go to Help > About Firefox/Thunderbird. 3. Allow the application to check for and install updates. 4. Restart the application when prompted.
🔧 Temporary Workarounds
Disable Native Messaging API
windowsPrevent web extensions from using the vulnerable native messaging API by disabling it via configuration.
Not applicable - configure via about:config in Firefox/Thunderbird
🧯 If You Can't Patch
- Restrict or audit web extensions that use native messaging API.
- Implement application sandboxing or exploit mitigation tools (e.g., EMET, Windows Defender Exploit Guard).
🔍 How to Verify
Check if Vulnerable:
Check the application version in Help > About Firefox/Thunderbird; if version is less than 144, it is vulnerable.Check Version:
firefox --version or thunderbird --versionVerify Fix Applied:
Confirm the application version is 144 or higher after updating.📡 Detection & Monitoring
Log Indicators:
- Application crash logs with memory corruption errors
- Unexpected process termination of Firefox/Thunderbird
Network Indicators:
- Unusual network activity from Firefox/Thunderbird processes post-crash
SIEM Query:
EventID=1000 OR EventID=1001 Source='Application Error' AND Process Name='firefox.exe' OR 'thunderbird.exe'