Memory safety bugs in Firefox 144 and Thunderbird 144 caused memory corruption, allowing, with sufficient effort, the execution of arbitrary code. The bugs correspond to well-known weaknesses in handling memory bounds and buffer overreads (CWE-119 and CWE-825).

Mozilla Firefox version 144 and Mozilla Thunderbird version 144 are affected. The vulnerabilities were addressed in Firefox 145 and Thunderbird 145, which should be installed to eliminate the risk.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% reflects a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. While the description does not state a precise attack vector, the nature of memory corruption suggests that exploitation would likely involve an attacker supplying malicious content (e.g., through a web page or email) that triggers the vulnerable code path. The attack would require the victim to run the affected software with the compromised content in a context that allows memory corruption.