Memory corruption bugs were found in specific releases of Firefox and Thunderbird. The vulnerability stems from improper boundary checks that can corrupt memory and, under certain conditions, may allow an attacker to execute arbitrary code. The weakness is identified as a classic buffer overflow (CWE-120) and carries a CVSS score of 9.8, indicating a severe risk to affected systems.

The affected products include Mozilla Firefox versions 148 and ESR 140.8, and Mozilla Thunderbird versions 148 and ESR 140.8. Any system still running these exact builds is vulnerable. The issue was resolved in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird ESR 140.9.

The CVSS score reflects a critical impact, while the EPSS assessment indicates a low probability of immediate exploitation. The vulnerability could be triggered by malicious web content or email content delivered to the affected applications. The attacker would need to supply crafted data that leads to memory corruption, after which code execution may be achieved. Though no official exploitation reports are available, the nature of the bug suggests that local or remote code execution is possible. The absence of the issue in the KEV catalog does not reduce its risk; the high severity score signals that the vulnerability should be treated with urgency.