Memory corruption bugs were identified in Firefox 145 and Thunderbird 145. These flaws could allow an attacker to craft input that triggers the corruption and runs arbitrary code with the privileges of the application, typical of buffer over-read or overflow weaknesses (CWE‑787).

Mozilla Firefox version 145 and Mozilla Thunderbird version 145 are affected; the vulnerabilities were fixed in Firefox 146 and Thunderbird 146, so upgrading to those releases or later mitigates the issue.

The CVSS score of 7.3 indicates a high severity while the EPSS score of less than 1% suggests that exploitation is considered unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would most likely occur through malicious content that a user processes, such as a crafted web page or email attachment, which then triggers the memory corruption.