Memory safety bugs were identified in Firefox 137 and Thunderbird 137 that enable memory corruption, and it is presumed that with sufficient effort an attacker could execute arbitrary code. The flaws involve stack and heap buffer overflows (CWE‑119 and CWE‑120). A successful exploitation would give an attacker the ability to run code with the same privileges as the user, potentially leading to full system compromise.

Mozilla Firefox version 137 and Mozilla Thunderbird version 137 are affected. Updates through Firefox 138 and Thunderbird 138 contain the necessary fixes.

The vulnerability carries a CVSS score of 6.5, reflecting moderate severity. The EPSS score is below 1%, indicating a low likelihood of exploitation under current conditions. It is not listed in CISA’s KEV catalog. While the exact attack vector is not explicitly documented, based on the nature of memory corruption in browsers it is inferred that exploitation could be achieved through a malicious web page, HTML content, or email attachment containing crafted data. The impact would be equivalent to remote code execution if the exploit succeeds.