Memory safety bugs were identified in Firefox 148 and Thunderbird 148 that can lead to memory corruption. The vendor’s analysis suggests that with sufficient effort, these bugs could be exploited to execute arbitrary code. The weaknesses involve improper handling of memory buffers (CWE‑120) and related buffer size mismatches (CWE‑825). If successfully leveraged, an attacker could gain complete control over a victim’s machine via the compromised browser or email client.

The flaws affect Mozilla Firefox 148 and Mozilla Thunderbird 148. They were addressed in the subsequent major release, Firefox 149 and Thunderbird 149, so any systems running the 148 releases or earlier remain vulnerable.

The CVSS score of 9.8 reflects a severe threat with full availability, confidentiality, and integrity impact. The EPSS score is below 1 %, indicating a low likelihood of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through malicious web content or email messages that contain specially crafted input to trigger the memory corruption. No publicly available exploit exists, so risk remains largely theoretical until an attacker produces a viable exploit.