A memory safety bug has been identified in Mozilla Firefox and Thunderbird, with the fix deployed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. The provided advisory does not specify the precise impact or exploitation method, so the consequences of the bug remain unspecified beyond the classification as a memory safety issue. The weakness is categorized under buffer overrun and out‑of‑bounds write, referencing CWEs 119 and 787.

Firefox versions older than 152 and Firefox ESR 140.12, as well as Thunderbird versions older than 152 and Thunderbird ESR 140.12, contain the vulnerable code. Any installation running those releases without the fix is at risk.

The CVSS score of 7.5 places this issue in the high severity range, indicating a potentially serious impact if memory corruption can be leveraged. The EPSS score of less than 1% and its absence from the CISA KEV catalog suggest that public exploitation is currently uncommon. No publicly documented exploits have been announced, and the official description does not specify a clear remote or local attack path, leaving the precise context of exploitation unclear.