CVE-2025-11719: 
NixOS vulnerability analysis and mitigation

CVE-2025-11719 is a use-after-free vulnerability affecting the native messaging API in web extensions on Windows platforms. The vulnerability was discovered by Filip Štamcar and disclosed on October 14, 2025. It affects Firefox versions prior to 144 and Thunderbird versions prior to 144, specifically impacting Firefox 143 and Thunderbird 143 (Mozilla Advisory, NVD).

The vulnerability is characterized by a use-after-free memory corruption issue that occurs when utilizing the native messaging API by web extensions specifically on Windows systems. The issue was introduced in Firefox 143 and has been assigned a moderate severity rating by Mozilla (Mozilla Advisory).

When exploited, this vulnerability can lead to crashes in the affected applications due to use-after-free memory corruption. The issue specifically impacts the functionality of web extensions using the native messaging API on Windows platforms (Mozilla Advisory).

The vulnerability has been patched in Firefox 144 and Thunderbird 144. Users are advised to update their applications to these versions to mitigate the risk. The fix was released as part of Mozilla's regular security updates (Mozilla Advisory, Mozilla Thunderbird).