The description identifies a memory safety bug that was fixed in Thunderbird 152, Thunderbird 140.12, Firefox 152, Firefox ESR 140.12, and Firefox ESR 115.37. It is classified as a buffer overflow (CWE-119) and an improper free of unowned memory (CWE-823). While the CVE text does not detail a specific exploitation path, memory corruption of this type could potentially enable arbitrary code execution or sensitive data disclosure if an attacker can trigger the bug through malicious content.

Mozilla Firefox users running a version earlier than 152, including the ESR tracks 140.12 and 115.37, are affected. Mozilla Thunderbird users on any version before 152 are also vulnerable. The fix is available in those later releases, so systems with the fixed versions are no longer at risk.

The EPSS score is reported as less than 1%, indicating a very low probability of exploitation. It is not listed in CISA’s KEV catalog. The CVSS score of 8.1 reflects high severity. The likely attack vector is local or file‑based, requiring delivery of malicious content that triggers the bug. Given the low exploitation probability, the overall risk for most organizations is moderate, but the potential impact warrants prompt remediation.