PT-2025-41907 · Mozilla+1 · Firefox+2

Filip Štamcar · Published 2025-10-14 · Updated 2026-04-15 · CVE-2025-11719

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 144 Thunderbird versions prior to 144

Description A flaw exists in Firefox and Thunderbird where the use of the native messaging API by web extensions on Windows may result in crashes due to use-after-free memory corruption. This issue impacts the stability of the applications when interacting with native messaging hosts.

Recommendations Update Firefox to version 144 or later. Update Thunderbird to version 144 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2025-13476

ALT-PU-2025-13478

BDU:2025-14554

CVE-2025-11719

OPENSUSE-SU-2025:15645-1

Affected Products

Alt Linux

Firefox

Thunderbird

References · 30

• https://osv.dev/vulnerability/CVE-2025-11719 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2025-81 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-84 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11719 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-11719 · Security Note
• https://mozilla.org/security/advisories/mfsa2025-84 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-11719 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15645-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11719 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14554 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2025-81 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2025-81/#CVE-2025-11719 · Vendor Advisory
• https://twitter.com/giuseppe_1337/status/2044245758778487134 · Twitter Post
• https://bugzilla.mozilla.org/show_bug.cgi?id=1991950 · Note
• https://suse.com/security/cve/CVE-2025-11713 · Note