CVE-2025-11708: 
NixOS vulnerability analysis and mitigation

CVE-2025-11708 is a high-severity use-after-free vulnerability discovered in the MediaTrackGraphImpl::GetInstance() function affecting multiple Mozilla products. The vulnerability was disclosed on October 14, 2025, impacting Firefox versions before 144, Firefox ESR versions before 140.4, Thunderbird versions before 144, and Thunderbird ESR versions before 140.4 (Mozilla Advisory, NVD).

The vulnerability is classified as a use-after-free (CWE-416) memory corruption issue in the MediaTrackGraphImpl::GetInstance() function. It received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating it can be exploited remotely with no privileges or user interaction required (NVD).

The vulnerability has a critical impact rating and could potentially allow attackers to execute arbitrary code. In Thunderbird, while the risk is mitigated when reading email due to disabled scripting, the vulnerability remains a potential risk in browser-like contexts (Mozilla Advisory).

The vulnerability requires no user interaction or special privileges to exploit, as indicated by its CVSS score. The use-after-free condition could potentially be exploited to achieve arbitrary code execution (NVD).

Mozilla has addressed this vulnerability in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird ESR 140.4. Users are advised to update to these versions or later to mitigate the risk (Mozilla Advisory).