A memory safety vulnerability affecting Mozilla Thunderbird and Firefox was identified. The flaw involves unsafe memory accesses such as buffer overflow or out‑of‑bounds reads or writes, consistent with the listed CWEs. The issue was addressed in Thunderbird version 152 and Firefox version 152, including the ESR 140.12 releases. No details about remote exploitation are provided, so the impact appears limited to local memory corruption or crashes.

Mozilla Firefox releases older than 152 and any ESR build older than 140.12 are vulnerable, as are Thunderbird releases before 152 and Thunderbird ESR editions older than 140.12 where the fix has not yet been deployed.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. With the available information, the likely attack vector is local code execution or requires elevated privileges; remote exploitation is unlikely without additional vulnerabilities.