CVE-2025-11719: Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption…

critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability was fixed in Firefox 144 and Thunderbird 144.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	firefox	—	—
mozilla	firefox	—	—
mozilla	firefox	>= 143.0 < 144.0	144.0
mozilla	thunderbird	>= 143.0 < 144.0	144.0

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

osv9.8CRITICAL