CVE-2025-11721: 
NixOS vulnerability analysis and mitigation

A memory safety vulnerability (CVE-2025-11721) was discovered in Firefox 143 and Thunderbird 143, disclosed on October 14, 2025. The vulnerability affects Firefox versions prior to 144 and Thunderbird versions prior to 144. This security issue shows evidence of memory corruption that could potentially be exploited (Mozilla Advisory, NVD).

The vulnerability is classified as a memory safety bug with a CVSS v3.1 base score of 9.8 (CRITICAL), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The bug is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (NVD).

The vulnerability could potentially allow an attacker to execute arbitrary code through memory corruption exploitation. The high severity rating indicates potential impacts on confidentiality, integrity, and availability of the affected systems (Mozilla Advisory).

The vulnerability has been fixed in Firefox 144 and Thunderbird 144. Users are advised to update their installations to these versions to mitigate the risk. For Thunderbird users, it's worth noting that the risk is minimized when reading email as scripting is disabled in the mail client (Mozilla Advisory).