The vulnerability consists of memory safety bugs that can lead to memory corruption in multiple versions of Firefox and Thunderbird. The flaw is inferred to be a buffer over-read or similar, and it is classified as CWE‑119 (inferred). The official description notes that, with sufficient effort, attackers could exploit the bugs to execute arbitrary code. The CVSS score of 8.1 reflects the potential for complete compromise of confidentiality, integrity, and availability. The flaw exists in earlier releases—Firefox ESR 115.26, ESR 128.13, ESR 140.1, the regular Firefox 141, Thunderbird ESR 128.13, ESR 140.1, and Thunderbird 141—and has been fixed in later versions with corresponding ESR releases.

Affected products include Mozilla Firefox and Thunderbird across both standard and Extended Support Release (ESR) branches. The vulnerable releases are Firefox ESR 115.26, ESR 128.13, ESR 140.1, the regular Firefox 141, Thunderbird ESR 128.13, ESR 140.1, and Thunderbird 141. The advisory lists the patched versions: Firefox 142 and ESR 115.27, ESR 128.14, ESR 140.2; Thunderbird 142 and ESR 128.14, ESR 140.2.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1 percent shows exploitation probability is currently low. The advisory does not list it in the CISA KEV catalog. The likely attack vector is a remote attacker providing crafted content to the browser to trigger memory corruption (inferred), but exact details are not disclosed; the description assumes that some bugs could be exploited for arbitrary code execution with enough effort (inferred). Therefore, the risk is significant for users running the affected versions, and even a low initial exploitation likelihood warrants prompt patching.