Memory safety bugs were discovered in multiple build lines of Mozilla Firefox and Thunderbird, including the standard release, latest release, and enterprise-focused ESR branches. These bugs triggered memory corruption; the description indicates that with sufficient effort, an attacker might have been able to execute arbitrary code. The weakness is classified as a buffer overflow and other memory-protection violations (CWE-787). The result would be loss of confidentiality, integrity, and availability for the affected user or system as an attacker would gain the privileges of the application process.

Mozilla products are impacted: Firefox versions 147 and 148, as well as ESR 115.33 and ESR 140.8, and Thunderbird versions 147 and 148, along with ESR 140.8. Older releases such as Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7 are vulnerable.

The CVSS score is 9.8, indicating critical severity. Exploit probability, per EPSS, is listed as less than 1 %, suggesting very low likelihood of active exploitation at this time, and the vulnerability is not currently in CISA’s KEV catalog. Likely vectors arise from user‑triggered content such as malicious web pages, emails, or attachment handling, but the exact attack path is not detailed in the advisories. The high severity indicates that any successful exploitation would allow full control of the affected process.