Memory safety bugs present in Thunderbird 152 may corrupt memory and could allow an attacker to run arbitrary code with sufficient effort, according to the advisory. The issues were fixed in Firefox 153 and Thunderbird 153.

Mozilla Firefox and Mozilla Thunderbird users running the 152 release were affected by this memory safety issue. Both products contained the same bugs, and the fixes were applied in version 153 of each product. Users of the affected releases remain at risk until a patch is applied.

The CVSS score of 9.8 classifies this vulnerability as critical, and the EPSS score of <1 % indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog at present. Based on the nature of memory corruption, the likely attack vector is the delivery of malformed data to Thunderbird, such as malicious attachments or corrupted content; this inference is made because the advisory does not specify a vector, but memory safety flaws typically arise from crafted inputs. The impact would be full control over the process, providing attackers with the ability to run arbitrary code on the victim’s machine.