The vulnerability involves memory safety bugs in Firefox and Thunderbird versions 147. Some bugs caused memory corruption, and while a direct exploit was not published, the analysis suggests that with sufficient effort an attacker could achieve arbitrary code execution. This would allow compromise of the user’s system, including theft of data, installation of malware, or further lateral movement.

Mozilla Firefox version 147 on all supported platforms, and Mozilla Thunderbird version 147 on all supported platforms. The issues are fixed in Firefox 148 and Thunderbird 148; any earlier release remains affected.

The CVSS score of 9.8 indicates a severe impact, and the EPSS score of less than 1% implies that at the time of analysis the likelihood of exploitation was considered very low. However, because the vulnerability can lead to arbitrary code execution and the product is widely used, security teams must treat it as a high‑risk issue. The exploitation path would involve delivering malicious content to the browser or email client, exploiting the memory safety bug to execute code in the user’s context. No confirmed public exploit exists, and the vulnerability is not listed in CISA’s KEV catalog at present.