These memory safety bugs enable memory corruption that could allow an attacker to execute arbitrary code on the host. The associated weaknesses are buffer overread or write errors, exposing the system to severe confidentiality, integrity, and availability impacts.

Vulnerable products include Mozilla Firefox version 145 and the 140.5 ESR release, and Mozilla Thunderbird version 145 and the 140.5 ESR release. The fixes are deployed in Firefox 146 and ESR 140.6, and in Thunderbird 146 and ESR 140.6.

The CVSS score of 8.1 indicates a high severity vulnerability, while the EPSS score of less than 1% shows a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker crafting malicious web content or email attachments that trigger the memory bug, leading to code execution; however, this inference is drawn from the type of memory corruption described and not explicitly stated in the advisory.