CVE-2025-11709 is an out-of-bounds read/write vulnerability in Mozilla Firefox caused by manipulated WebGL textures. A compromised web process could exploit this flaw to perform memory corruption in a more privileged process, potentially leading to arbitrary code execution or other severe impacts. The vulnerability has a CVSS 3.1 base score of 9.8 (critical), reflecting its network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Mozilla fixed this issue in Firefox 144 and ESR versions 115.29 and 140.4, as well as Thunderbird versions 144 and 140.4. The vendor advisory confirms the fix and provides detailed references to the underlying bug (Bug 1989127).

The vulnerability enables a compromised web process to cause out-of-bounds memory reads and writes in a privileged process, which can lead to memory corruption. This can result in arbitrary code execution, data leakage, or denial of service. The CVSS score of 9.8 indicates critical severity with high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, but the potential impact is severe if exploited.

Mozilla has released official fixes for this vulnerability in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official updates.