Memory corruption was discovered in Firefox 143 and Thunderbird 143. This bug allowed an attacker to corrupt the heap or stack and potentially execute arbitrary code. The result could be full control over the vulnerable application, enabling disclosure of sensitive information, remote code execution, and other malicious actions. The weakness corresponds to CWE‑119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

The affected products are Mozilla Firefox and Mozilla Thunderbird, specifically version 143. Users running Firefox 143 or Thunderbird 143 must update, as the bug does not exist in Firefox 144, Thunderbird 144, or later releases.

The vulnerability carries a CVSS base score of 9.8, indicating critical severity. The EPSS score is reported as less than 1 %, signifying a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Exploitation would likely require the victim to provide crafted input or otherwise trigger the bug during rendering or message handling. While current exploitation risk appears low, the high severity warrants prompt remediation.