Memory corruption bugs were discovered in Firefox and Thunderbird versions 135 and 128.7, respectively. The flaws allow the applications to write or read outside allocated memory during handling of specially crafted input, potentially enabling an attacker to execute arbitrary code. The advisory notes that, with sufficient effort, such bugs could be leveraged to run code of the attacker's choosing, representing a significant impact on affected systems.

Mozilla Firefox 135, Firefox ESR 128.7, Thunderbird 135, and Thunderbird 128.7 are vulnerable. Red Hat Enterprise Linux 8 and 9 systems may run these browsers, as indicated by the supplied CPE entries; any installation of the unpatched browsers on those platforms is at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. No entry appears in the CISA KEV catalog, indicating no known active exploitation. The probable attack vector involves supplying malicious content—such as a crafted web page or email attachment—to the browser, which could trigger the memory corruption and lead to code execution. Because the weaknesses are memory safety defects (CWE‑120 and CWE‑787), reverse engineering the precise trigger input would be required, making the attack effort‑dependent.