CVE-2025-11721 is a critical severity (NVD score 9.8) memory safety bug in Firefox 143 and Thunderbird 143. Mozilla saw evidence of memory corruption and presumes it could have been exploited to run arbitrary code with enough effort. It is fixed in Firefox 144 and Thunderbird 144, so update both.
What's affected
The record lists Mozilla Firefox and Thunderbird. The description says a memory safety bug was present in Firefox 143 and Thunderbird 143. It showed evidence of memory corruption, and Mozilla presumes that with enough effort it could have been exploited to run arbitrary code. The record classes it under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).
The fix ships in Firefox 144 and Thunderbird 144. Mozilla lists it in mfsa2025-81 for Firefox and mfsa2025-84 for Thunderbird, announced on 14 October 2025, and rates the impact as high.
The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In the Thunderbird advisory, Mozilla notes that these flaws generally cannot be exploited through email because scripting is disabled when reading mail, but they are potentially risks in browser or browser like contexts.
How to check if you're exposed
In Firefox, open the menu, then Help, then About Firefox. In Thunderbird, use Help, then About Thunderbird. A version number of 143 is the one the record names, and 144 or later includes the fix.
On Linux, you can check from a terminal:
firefox --version
thunderbird --version
On managed Windows and Mac fleets, use your software inventory to list versions and flag anything below 144. Do not forget portable copies, kiosk machines, and virtual desktop images, which are updated on a different cycle.
Mozilla also ships extended support releases. This advisory item names Firefox 143 and Thunderbird 143 only, so check the advisory text for your release channel.
What to do now
-
Update Firefox and Thunderbird to version 144 or later everywhere.
-
Check virtual desktop images and golden images, then rebuild them with the new version.
-
Confirm completion through inventory data, with a list of machines still below 144.
-
Keep automatic updates on, and shorten the delay for managed deployments of browsers.
-
Reduce risk while you wait by limiting browsing on high value machines to trusted sites.
-
Add browser versions to your regular vulnerability reporting, since this class of bug appears in nearly every release.
Why it matters
Memory safety bugs, tracked here as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), come from code that reads or writes memory it should not. Mozilla uses this label when engineers find evidence of corruption but have not built a working attack. The wording is cautious by design, and the advice is to treat it as serious.
The NVD score of 9.8 reflects the worst case in the generic scoring vector. In practice a browser has several layers of protection, so one memory bug rarely stands alone. Still, the fix cost is low, since it is a normal browser update, and the delay cost is high if an update backlog builds.
Which of your findings are reachable matters more than the raw count. That is where reachability analysis helps with libraries in your own code.
The record does not mark the CVE as exploited in the CISA Known Exploited Vulnerabilities catalog, and the advisories I fetched do not report exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does Mozilla say this was exploited?
No. The advisory says the bug showed evidence of memory corruption and that Mozilla presumes it could have been exploited with enough effort. That is a presumption, not a report of attacks.
Which version fixes it?
Firefox 144 and Thunderbird 144, per the Mozilla advisories mfsa2025-81 and mfsa2025-84.
Sources
- CVE-2025-11721 on Safeguard Gold
- NVD record for CVE-2025-11721
- Mozilla Foundation Security Advisory 2025-81 (Firefox)
- Mozilla Foundation Security Advisory 2025-84 (Thunderbird)
Last reviewed: 19 October 2026.
