This vulnerability involves memory safety bugs in various versions of Mozilla Firefox and Thunderbird. The bugs can cause buffer overflows or out‑of‑bounds reads that may allow an attacker to corrupt program memory. If successfully exploited, the attacker could gain arbitrary code execution privileges within the process, potentially compromising the entire system.

Affected products include Mozilla Firefox released through version 134 and the ESR 115.19/128.6 branches, as well as Mozilla Thunderbird through version 134 and ESR 115.19/128.6. Versions 135, 128.7, and the ESR 115.20/128.7 releases contain the fix.

The CVSS base score of 9.8 marks the flaw as critical. The EPSS score of less than 1% indicates a low likelihood of automated exploitation at present, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote content that a user opens in the affected client, such as a malicious web page or email attachment. An attacker would need to craft a payload that triggers the memory corruption. Successful exploitation could lead to arbitrary code execution, providing full control of the affected user’s environment.