Thunderbird’s updater contains a flaw that lets a local user process with medium integrity inject code to interfere with the SYSTEM‑level update mechanism. By manipulating file‑locking, the attacker can bypass access controls and perform SYSTEM‑level file operations on paths that are normally controlled by a non‑privileged user. This fault is categorized under CWE‑22 (Path Traversal) and CWE‑94 (Code Injection), allowing the malicious actor to gain higher privileges on the machine.

The vulnerability affects Mozilla’s Thunderbird and Firefox browsers. It is present in Thunderbird and Firefox releases prior to version 138, and in Firefox ESR builds before 128.10 and 115.23. System administrators running Red‑Hat Enterprise Linux 8, 9, and related extended‑support releases are potentially impacted when the updater runs as SYSTEM. All environments where the updater is enabled on an affected client should be examined.

The CVSS score of 8.8 reflects a high severity due to the potential for privilege escalation. The EPSS score is below 1%, indicating that exploitation is currently considered unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires local, medium‑integrity access—typically the ability to run code as a logged‑in user. An attacker could then trigger the updater to execute SYSTEM‑level actions, effectively elevating privileges and compromising system integrity.