External risk intelligence

Firefox and Thunderbird Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-11708

The vulnerability exists within web browsers and email clients (Firefox and Thunderbird). These applications are user-facing client software rather than internet-facing services, gateways, or APIs. While they process internet content, they are not typically deployed as reachable network services or infrastructure, making them unlikely to present a public-facing attack surface in the context of this metric.

Use After Free

Mozilla Firefox

before 140.4.0before 144.0141.0 to before 144.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in specific versions of Mozilla's Firefox and Thunderbird software, stemming from a use-after-free error within the MediaTrackGraphImpl component. This type of vulnerability can be exploited remotely and may allow an attacker to compromise the affected software, potentially leading to significant data loss or system control. While the issue has been addressed in newer versions, confirming exposure is the primary concern.

Flaw impacts browser and email software.
Confirms our software is up-to-date.
Ensure all software is updated to prevent risks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into visiting a malicious webpage or opening a specially crafted email. This would lead to the execution of code within the context of the vulnerable application, potentially allowing the attacker to compromise the user's system.

No authentication required.
Triggered via malicious web content or email.
Full system compromise is possible.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in MediaTrackGraphImpl::GetInstance could allow an attacker to impact application stability or integrity. This could occur when processing specific media data, potentially leading to crashes or unexpected behavior in affected applications.

Application stability and integrity at risk.
Unstable media processing could trigger it.
Application crashes or unexpected behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Firefox and Thunderbird affects user-facing client applications. The first practical step is to identify which users and systems have the affected software, confirm if it's business-critical, and then coordinate with users or IT support for remediation.

Application owners should manage this issue.
Verify software versions and user impact.
Plan controlled updates and user communication.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2025-11708?

This vulnerability impacts Mozilla Firefox and Thunderbird. These are widely used client applications: Firefox is a web browser for navigating the internet, and Thunderbird is an email client for managing messages and calendars. They both utilize the MediaTrackGraph component to process and render various media streams, such as audio or video content displayed within webpages or embedded in emails.

How does a use-after-free vulnerability work in this context?

This is a memory management flaw, specifically categorized as CWE-416. It occurs when an application continues to use a pointer to a memory location after that memory has already been cleared or released. In this CVE, the MediaTrackGraphImpl component fails to properly manage memory during media processing, which can lead to unpredictable behavior, system crashes, or the potential for unauthorized code execution.

What triggers this vulnerability?

The flaw is triggered when the software processes specially crafted media content. An attacker must entice a user to visit a malicious website or open a malicious email containing this content. It is important to note that simply having the software installed does not trigger the bug; the application must actively interact with the malicious data for the memory error to occur.

Why is this not considered an internet-facing service?

Halo Surface Signal notes that while Firefox and Thunderbird process internet content, they are client-side applications rather than infrastructure services like web servers or APIs. They do not typically listen for unsolicited inbound connections from the internet. Because they are not deployed as reachable network services, they are classified as having an external exposure type but are unlikely to present a direct, public-facing network attack surface.

What should I do if I am running these versions?

The primary response is to update your software to a version where this issue has been resolved. For Firefox, ensure you are running version 144 or later, or 140.4 for the ESR channel. For Thunderbird, update to version 144 or 140.4. Coordinate with your IT team or individual users to verify installed versions and ensure these updates are applied to maintain application integrity and stability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.