Skip to main content

Thunderbird CVE-2025-11711

MEDIUM
Sensitive Data Storage in Improperly Locked Memory (CWE-591)
2025-10-14 security@mozilla.org
Information Disclosure Mozilla Thunderbird
6.5
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker crafts malicious web page
  2. Delivery
    Victim visits site in Firefox/Thunderbird
  3. Exploit
    Malicious JavaScript executes
  4. Execution
    Property descriptor bypass modifies read-only object
  5. Persist
    Application state corrupted or security controls bypassed
  6. Impact
    Potential privilege escalation or data manipulation

Vulnerability Assessment

Weakness
CWE
CWE-591
ASVS 5.0
V15 - Secure Coding and Architecture Sensitive data in persistent store
Impact

CVSS 6.5 indicates moderate-to-significant risk driven by unauthenticated network attack vector (AV:N), low attack complexity (AC:L), and high integrity impact (I:H), offset by user-interaction requirement (UI:R) and unchanged confidentiality/availability (C:N/A:N). The integrity-focused impact suggests this is a privilege escalation or state-corruption vulnerability rather than direct data theft. Exploitation requires a malicious website or content delivery mechanism; victims must visit attacker-controlled pages. No public exploit code or CISA KEV status indicated, reducing immediate threat level. Real-world impact depends on whether property modifications enable further attacks (sandbox escape, privilege escalation within the application context) or merely corrupt application state. The user-interaction requirement significantly reduces automation potential compared to network-only vulnerabilities. This is a legitimate, non-trivial vulnerability affecting widespread products but not an active threat at time of analysis.
Exploit ScenarioDerived

An attacker creates a malicious web page containing JavaScript that attempts to modify read-only Object properties (e.g., Object.defineProperty or similar mechanisms) that are normally immutable. When a victim visits the page in a vulnerable Firefox or Thunderbird build, the JavaScript executes within the application's context and successfully overwrites protected properties, potentially corrupting application state, bypassing security checks embedded in object properties, or enabling further privilege escalation within the JavaScript sandbox. No public proof-of-concept is known to be widely available.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 13, 2026

Modify read-only JavaScript Object properties in Firefox and Thunderbird via crafted web content, allowing attackers to bypass property immutability protections and alter application state. Affects Firefox versions below 144, Firefox ESR below 115.29 and 140.4, Thunderbird below 144 and 140.4. Requires user interaction (malicious website visit) but no authentication. CVSS 6.5 reflects high integrity impact with user-interaction requirement; no evidence of active exploitation or public exploit code at time of analysis.

RemediationAI

Upgrade Firefox to version 144 or later (standard release), Firefox ESR to 115.29 or later (ESR 115 track) or 140.4 or later (ESR 140 track). Upgrade Thunderbird to version 144 or later (standard release) or 140.4 or later (ESR 140 track). Vendor-released patches are available via Mozilla's official distribution channels and security advisories (https://www.mozilla.org/security/advisories/mfsa2025-81/, mfsa2025-82, mfsa2025-83, mfsa2025-84, mfsa2025-85). Users unable to patch immediately should avoid visiting untrusted websites and disable JavaScript execution in high-risk contexts if feasible, though this is not a practical workaround for standard users. Linux distributions including Debian have released package updates (per debian-lts-announce references).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the JavaScript engine's object property handling, specifically in the mechanisms that enforce read-only (non-writable) property descriptors defined in the ECMAScript specification. JavaScript objects support property descriptors with writable flags that prevent modification of critical properties; this vulnerability bypasses those protections through an unspecified method. The flaw is classified under CWE-591 (Sensitive Data Exposure via Property Manipulation), indicating improper access control on object properties that should be immutable. The attack surface spans all JavaScript execution contexts in Firefox and Thunderbird, including script execution triggered by visiting hostile web pages or processing untrusted content.

Know when Thunderbird gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
SUSE MEDIUM
Red Hat 7.5 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

DescriptionCVE.org

There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

More in Thunderbird

View all
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-591 – Sensitive Data Storage in Improperly Locked Memory

View all
CVE-2023-28229 HIGH POC
7.0
CVE-2024-34525 MEDIUM POC
5.3
CVE-2024-38131 HIGH
8.8
CVE-2025-24035 HIGH
8.1
CVE-2025-27482 HIGH
8.1
CVE-2025-24045 HIGH
8.1
CVE-2024-49123 HIGH
8.1
CVE-2023-36005 HIGH
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:2.2.0-4.10 Container suse/sl-micro/6.1/base-os-container:2.2.0-4.9 Container suse/sl-micro/6.1/kvm-os-container:2.2.0-4.8 Container suse/sl-micro/6.1/rt-os-container:2.2.0-4.9 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:18154 ADVISORY https://access.redhat.com/errata/RHSA-2025:18155 ADVISORY https://access.redhat.com/errata/RHSA-2025:18285 ADVISORY https://access.redhat.com/errata/RHSA-2025:18320 ADVISORY https://access.redhat.com/errata/RHSA-2025:18321 ADVISORY https://access.redhat.com/errata/RHSA-2025:18983 ADVISORY https://access.redhat.com/errata/RHSA-2025:19278 ADVISORY https://access.redhat.com/errata/RHSA-2025:19938 ADVISORY https://access.redhat.com/errata/RHSA-2025:19939 ADVISORY https://access.redhat.com/errata/RHSA-2025:19941 ADVISORY https://access.redhat.com/errata/RHSA-2025:19942 ADVISORY https://access.redhat.com/errata/RHSA-2025:19943 ADVISORY https://access.redhat.com/errata/RHSA-2025:19944 ADVISORY https://access.redhat.com/errata/RHSA-2025:19945 ADVISORY https://access.redhat.com/errata/RHSA-2025:21054 ADVISORY https://access.redhat.com/errata/RHSA-2025:21055 ADVISORY https://access.redhat.com/errata/RHSA-2025:21056 ADVISORY https://access.redhat.com/errata/RHSA-2025:21057 ADVISORY https://access.redhat.com/errata/RHSA-2025:21058 ADVISORY https://access.redhat.com/errata/RHSA-2025:21059 ADVISORY https://access.redhat.com/errata/RHSA-2025:21064 ADVISORY https://vuldb.com/vuln/328241 ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-81/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-82/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-83/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-84/ ADVISORY https://www.mozilla.org/security/advisories/mfsa2025-85/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21021/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4006/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4173/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4174/ REF https://bugzilla.mozilla.org/show_bug.cgi?id=1989978 REF https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html REF https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy