Memory safety bugs in Mozilla Firefox and Thunderbird lead to memory corruption that could be leveraged to execute arbitrary code. The underlying weaknesses are identified as buffer overflows (CWE‑120) and out‑of‑bounds writes (CWE‑787). If successfully exploited, the attacker could take full control of the affected application, compromising confidentiality, integrity, and availability of the system.

Mozilla Firefox versions 133 and earlier, including ESR releases 115.18 and 128.5, and Mozilla Thunderbird versions 133 and earlier, including ESR releases 115.18 and 128.5, are affected. The vulnerability is resolved in Firefox 134, ESR 115.19/128.6, Thunderbird 134, and ESR 115.19/128.6.

The CVSS score of 6.5 places the vulnerability in the medium severity range, while an EPSS score of 2% indicates a low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly documented in the provided description; based on the nature of the memory corruption it is inferred that an attacker would need to supply crafted data or execute code in a local or privileged context to trigger the defect. Achieving the exploit would require significant effort and detailed knowledge of the affected browser internals.