The vulnerability consists of memory safety bugs in multiple versions of Firefox and Thunderbird that can lead to unintended memory corruption. The bugs are reported as potential buffer over-read and buffer overflow weaknesses (CWE‑120, CWE‑787). If successfully exploited, the attacker could gain arbitrary code execution within the context of the vulnerable application.

Affected products include Mozilla Firefox versions 134 and Firefox ESR 128.6, Mozilla Thunderbird versions 134 and Thunderbird ESR 128.6. Systems running these versions on any platform are at risk until the updated patches are installed. The patches are available for all supported operating systems, including the Red Hat Enterprise Linux families referenced in the advisory.

The CVSS score of 9.8 indicates a high severity and the low EPSS score of <1% suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The known exploited form is not documented, but based on the memory corruption nature, a local attacker who can supply crafted input or trigger native code paths has a plausible exploitation path that could eventually lead to arbitrary code execution.