Memory safety bugs were discovered in older releases of Mozilla Firefox and Thunderbird. The defects can corrupt memory and the severity score of 9.8 indicates that an attacker who can exploit these bugs could run arbitrary code on the affected client. The vulnerability is classified as CWE‑787, a classic heap or buffer overflow weakness that undermines the confidentiality and integrity of the system.

Affected applications include Mozilla Firefox ESR 140.7, Firefox 147, Mozilla Thunderbird ESR 140.7, and Thunderbird 147. The fixes were shipped in Firefox 148 and ESR 140.8 and Thunderbird 148 and ESR 140.8.

The base CVSS score of 9.8 signals critical impact, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so no public exploitation has been confirmed. Because the description does not state the exact attack vector, it is inferred that an attacker would need to supply malicious input that triggers the memory corruption, which typically requires local or privileged execution context or remote input that can force the bug.