The vulnerability involves memory safety bugs in Mozilla Firefox ESR 140.2, Firefox 142, Thunderbird ESR 140.2, and Thunderbird 142 that can corrupt memory boundaries. When exploited, these bugs could allow an attacker to execute arbitrary code, compromising confidentiality, integrity, and availability of the affected system. The weakness is identified as a bounds‑checking failure.

All systems running the affected versions of Mozilla Firefox and Thunderbird— including the ESR 140.2 family and the mainstream 142 releases— are potentially impacted. Red Hat Enterprise Linux 9 and 10 are listed as platforms that may run these browsers, but the core issue resides in the browser software itself. The fixes are delivered in Firefox 143 and ESR 140.3, as well as Thunderbird 143 and ESR 140.3.

The CVSS score of 8.8 classifies this as a high‑severity flaw, while the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Although the attack vector is not explicitly defined in the description, it is inferred that an attacker would need to supply crafted content or exploit a browser feature that triggers the memory corruption, potentially through local or remote means. The available data do not indicate a publicly available exploit, but the high severity warrants prompt mitigation.