CVE-2025-11708

CRITICAL 9.8CVE-2025-11708 · Published 14/10/2025 · updated 23/10/2026

Package	Affected versions	Patched versions
firefox mozilla	`< 140.4.0< 144.0`	`140.4.0144.0`
thunderbird mozilla	`≥ 141.0, < 144.0< 140.4.0`	`144.0140.4.0`

Description

Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

References

bugzilla.mozilla.org/show_bug.cgi · Issue Tracking
mozilla.org/security/advisories/mfsa2025-81 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-83 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-84 · Vendor Advisory
mozilla.org/security/advisories/mfsa2025-85 · Vendor Advisory
lists.debian.org/debian-lts-announce/2025/10/msg00015.html
lists.debian.org/debian-lts-announce/2025/10/msg00031.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free