This vulnerability is a memory safety flaw affecting Mozilla Firefox and Thunderbird, identified as a buffer overflow (CWE‑119) and an improper free of memory not owned (CWE‑823). The bug allows an attacker to corrupt process memory, which may result in arbitrary code execution or sensitive data disclosure. The description does not provide a specific exploitation path, but such memory corruption vulnerabilities commonly permit privilege escalation or remote code execution if the attacker can influence memory usage.

Mozilla Firefox users running a version earlier than 152, including the ESR tracks 140.12 and 115.37, are affected. Mozilla Thunderbird users on any version before 152 are also vulnerable. The fix is available in those later releases, so systems with the fixed versions are no longer at risk.

The EPSS score is reported as less than 1%, indicating the known probability of exploitation is very low, and it is not listed in CISA’s KEV catalog. The CVSS score is 8.1, indicating a high severity. The likely attack vector is local or file‑based, meaning the attacker would need to deliver malicious content that triggers the bug. Given the low exploitation probability, the overall risk for most organizations is moderate, but the potential impact warrants prompt remediation.