CVE-2025-11708 is a use-after-free vulnerability in the MediaTrackGraphImpl::GetInstance() function within Mozilla Firefox. This type of vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption and arbitrary code execution. The flaw was addressed and fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. The vulnerability carries a CVSS 3.1 base score of 9.8 (critical), reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The Mozilla Foundation security advisories mfsa2025-81 and mfsa2025-83 provide detailed information and confirm the patch status.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code within the context of the affected application, potentially leading to full compromise of the user's browser environment. The CVSS score of 9.8 reflects critical severity with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of advisory publication.

An official fix is available and has been released by Mozilla. Users and administrators should update to Firefox 144, Firefox ESR 140.4, Thunderbird 144, or Thunderbird 140.4 or later to remediate this vulnerability. No additional mitigation steps are required beyond applying the official patches.