Memory corruption bugs were identified in several builds of Mozilla Firefox and Thunderbird, including both regular and extended support editions. The faults allow an attacker to corrupt memory while the applications process data, and with sufficient effort could lead to arbitrary code execution. This would grant an attacker full control of the affected system, compromising confidentiality, integrity, and availability.

Mozilla Firefox versions 115.26, 128.13, 140.1, 141 and earlier releases 115.25, 128.12, 140.0, 140 are affected. Mozilla Thunderbird versions 128.13, 140.1, 141 and earlier releases 128.12, 140.0, 140 are affected. Packages distributed for Red Hat Enterprise Linux 8, 9 and 10 also contain the vulnerable binaries, so systems running these distributions are at risk until updated.

The CVSS score of 8.8 classifies the flaw as high severity, indicating that exploitation can provide substantial damage. The EPSS score of less than 1% indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The weakness (CWE‑119) is a classic buffer overflow scenario that could be triggered by memory corruption. The likely attack vector is the presentation of malicious content to the browser or mail client, such as a compromised web page, email attachment, or add‑on. Based on the description, it is inferred that such remote or local content could be used to activate the memory corruption, but no publicly disclosed exploit is available at this time.