Memory safety bugs in Mozilla Firefox and Thunderbird involve heap overflows (CWE‑119), out‑of‑bounds reads (CWE‑125), and out‑of‑bounds writes (CWE‑787). These flaws can corrupt memory and, given sufficient effort, allow an attacker to run arbitrary code. The likely attack vector is through crafted web content or malicious email attachments, inferred from the described memory corruption and potential arbitrary code execution.

Affected products include Mozilla Firefox, namely the ESR 115.x and ESR 140.x branches and the base releases 143 and 144, and Mozilla Thunderbird, specifically the ESR 140.x branch and the base releases 143 and 144. The security fixes were deployed in Firefox 144, Firefox ESR 115.29 and 140.4, Thunderbird 144 and Thunderbird ESR 140.4. Users running earlier versions are vulnerable.

The CVSS v3.1 score of 8.8 indicates high severity. The EPSS score is below 1%, suggesting a low probability of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the potential for arbitrary code execution through crafted web pages or malicious email attachments means the risk remains significant for users of unpatched browsers. The attack vector is inferred from the nature of the memory corruption rather than explicitly stated in the CVE description.