Memory safety bugs were discovered in Firefox ESR 140.1, Firefox 141, Thunderbird ESR 140.1, and Thunderbird 141. The bugs caused memory corruption, and the description indicates that an attacker could, with sufficient effort, run arbitrary code. The impact of a successful exploitation would compromise the confidentiality, integrity, and availability of the affected system.

The affected products are Mozilla Firefox and Thunderbird. Versions 140.1 and 141 of both Firefox and Thunderbird were vulnerable. The vulnerabilities are fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird ESR 140.2.

The vulnerability carries a CVSS score of 8.1, indicating a high severity, but the EPSS score is less than 1% and it is not listed in the CISA KEV catalog. The likely attack vector involves either malicious web content or email attachments that trigger the memory corruption when processed by an unpatched browser or email client. Exploitation would likely require a user to view or open the malicious content but could be carried out without elevated privileges. Overall, the risk remains high due to the severity, but the probability of widespread exploitation is currently low.