CVE-2025-11721 is a memory safety bug present in Firefox 143 and Thunderbird 143 that showed evidence of memory corruption. While no known exploits in the wild have been reported, the vulnerability could have been exploited to run arbitrary code with sufficient effort. Mozilla fixed this vulnerability in Firefox 144 and Thunderbird 144. The CVSS v3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability. This issue is part of a set of memory safety bugs addressed in the same release cycle.

The vulnerability allows for potential arbitrary code execution due to memory corruption in affected versions of Firefox and Thunderbird. This poses a critical risk to users as it could lead to full compromise of the affected applications. No known exploits have been observed in the wild at the time of disclosure. The impact affects confidentiality, integrity, and availability of the affected software.

Mozilla has released official fixes for this vulnerability in Firefox 144 and Thunderbird 144. Users and administrators should update to these or later versions to remediate the issue. Since this is not a cloud service, patching the client software is required. Patch status is confirmed by the vendor advisory. No additional mitigation actions are indicated beyond applying the official updates.