These memory safety bugs were found in Firefox 139 and Thunderbird 139. They involve unsafe memory handling that could lead to corruption. If successfully exploited, they may allow an attacker to gain control of the application, leading to arbitrary code execution. The weakness is classified as CWE‑119, which indicates out‑of‑bounds read or write vulnerabilities.

The bugs affect Mozilla Firefox version 139 and Mozilla Thunderbird version 139. Any installation of these versions, regardless of platform, is vulnerable. The issue was addressed in Firefox 140 and Thunderbird 140, so users of newer releases are not impacted.

The CVSS score of 8.1 denotes high severity. The EPSS score is below 1%, suggesting that the likelihood of exploitation is low but not zero. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation at present. The attack vector would typically involve delivering malicious web content or email that triggers the vulnerable memory handling, but attackers would need significant effort to create a working exploit.