CVE-2025-11719: 
NixOS vulnerability analysis and mitigation

CVE-2025-11719 is a use-after-free vulnerability discovered in Firefox 143 and Thunderbird 143's native messaging API implementation on Windows systems. The vulnerability was disclosed on October 14, 2025, affecting Firefox versions from 143.0 up to (excluding) 144.0 and Thunderbird versions in the same range. The issue was reported by security researcher Filip Štamcar (Mozilla Advisory).

The vulnerability is classified as a use-after-free memory corruption issue that occurs specifically when using the native messaging API by web extensions on Windows platforms. It has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating high severity across confidentiality, integrity, and availability impacts (NVD).

The vulnerability could lead to crashes in the affected applications due to use-after-free memory corruption. Given the CVSS score and vector, the vulnerability potentially allows for remote code execution with no user interaction required, affecting the confidentiality, integrity, and availability of the system (Mozilla Advisory).

The vulnerability has been patched in Firefox 144 and Thunderbird 144. Users are advised to upgrade to these versions to mitigate the risk. For Thunderbird users, it's worth noting that the risk is somewhat reduced as scripting is disabled when reading mail, though the vulnerability could still be exploited in browser-like contexts (Mozilla Advisory).