Memory safety bugs in Mozilla Firefox 133 and Thunderbird 133 can corrupt memory; if exploited, an attacker could achieve arbitrary code execution. The vulnerability is reported as a memory corruption issue that could be used to run code with the privileges of the application. The impact is therefore a critical compromise of confidentiality, integrity, and availability for affected users.

The affected products are Mozilla Firefox version 133 and Mozilla Thunderbird version 133. Both applications were patched in the subsequent 134 releases, and no other versions are reported to be affected.

The CVSS score of 9.8 indicates a high severity, and an EPSS score of 15% suggests a non-negligible likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog, but the high CVSS, the evidence of memory corruption, and the potential for remote code execution make this a serious risk. Attackers would likely need to supply malicious content, such as a web page or email attachment, to trigger the bug; the exact vector is not specified in the advisory, so the risk applies to users who render or open untrusted content.