The vulnerability is a set of memory safety bugs in Firefox 146 and Thunderbird 146 that can corrupt memory. Several of these bugs were shown to corrupt memory, and the description indicates that with sufficient effort they could have allowed an attacker to run arbitrary code on the victim machine. The weakness is a classic buffer overflow (CWE-119).

Mozilla Firefox version 146 and Mozilla Thunderbird version 146 are affected. The bugs were fixed in Firefox 147 and Thunderbird 147, so any user running the older major releases is at risk.

The CVSS score of 9.8 reflects the severe impact of the vulnerability, with full confidentiality, integrity, and availability compromise if exploited. However, the EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, indicating that exploitation is currently unlikely or not widely observed. Based on the nature of the bug, the probable attack vector involves delivering crafted content—such as a malicious webpage or email—that triggers the memory corruption. No specific external attack method is defined in the advisory, so the inference is that a standard content-based exploit is the likely path.