Memory safety bug (CWE‑119) was fixed in Mozilla Thunderbird 152, Thunderbird 140.12, Mozilla Firefox 152, and Firefox ESR 140.12. The advisory does not enumerate precise exploitation outcomes, yet such bugs typically allow crashes, data corruption, or arbitrary code execution when manipulated data is processed.

Mozilla Firefox (versions 152 and Firefox ESR 140.12) and Mozilla Thunderbird (versions 152 and 140.12) are impacted. Users running older releases of either browser or mail client have not received the patch and remain vulnerable.

The CVSS score of 5.3 indicates a moderate severity impact. The EPSS score of less than 1 % suggests that, as of the latest data, the probability of exploitation in the wild is low. The vulnerability is not listed in the CISA KEV catalog, further indicating limited real-world exploitation. The absence of an explicit attack vector in the description leaves the exact method of exploitation unclear; however, memory‑corruption flaws are typically exploited through crafted data or content processed by the affected application, potentially requiring local or remote user interaction. Given the moderate CVSS and low EPSS, organizations may treat this as a low‑to‑moderate priority issue pending application of the available patches.