Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Microsoft
  • Windows
Mozilla
  • Firefox
  • Thunderbird

Configuration 1 [-]

AND
OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References
Link Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1991950 cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-11719 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-11719 cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-81/ cve-icon cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2025-84/ cve-icon cve-icon cve-icon
History

Fri, 14 Nov 2025 15:30:00 +0000

Type Values Removed Values Added
Description Starting in Firefox 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144. Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144.

Thu, 30 Oct 2025 16:30:00 +0000

Type Values Removed Values Added
Title thunderbird: firefox: Use-after-free caused by the native messaging web extension API on Windows Use-after-free caused by the native messaging web extension API on Windows

Wed, 15 Oct 2025 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Wed, 15 Oct 2025 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
Mozilla
Mozilla firefox
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows
Mozilla
Mozilla firefox

Wed, 15 Oct 2025 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 15 Oct 2025 12:30:00 +0000

Type Values Removed Values Added
Title thunderbird: firefox: Use-after-free caused by the native messaging web extension API on Windows
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

threat_severity

Moderate

Tue, 14 Oct 2025 13:00:00 +0000

Type Values Removed Values Added
Description Starting in Firefox 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144.
References
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2025-11-14T15:23:56.437Z

Reserved: 2025-10-13T19:50:20.373Z

Link: CVE-2025-11719

cve-icon Vulnrichment

Updated: 2025-10-15T13:20:57.558Z

cve-icon NVD

Status : Modified

Published: 2025-10-14T13:15:38.287

Modified: 2025-11-14T16:15:49.790

Link: CVE-2025-11719

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-10-14T12:27:36Z

Links: CVE-2025-11719 - Bugzilla