This vulnerability arises from memory safety bugs in Mozilla Firefox and Thunderbird that allow an attacker to corrupt heap memory; while the description does not detail a specific exploit, it is inferred that the memory corruption could be leveraged to run arbitrary code when sufficient effort is applied. Based on the description, the likely attack vector involves delivery of crafted content, such as malicious web pages or email attachments, through the application when an attacker can inject or open such data.

Affected are Mozilla Firefox versions 140, the ESR releases 128.12 and 140.0, and the corresponding Thunderbird releases 140, 128.12, and 140.0. These versions are superseded by Firefox 141, ESR 128.13, ESR 140.1, and Thunderbird 141, Thunderbird 128.13, Thunderbird 140.1, which contain the fix.

The CVSS score of 8.8 signals a high severity for potential remote code execution. The EPSS score of less than 1% indicates a low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the high CVSS score indicates a significant risk if an exploit were to be found, so the vulnerability should be treated with high priority.