Memory safety bugs were discovered in Firefox and Thunderbird that caused memory corruption. Several of the bugs demonstrated evidence of memory corruption and could, with enough effort, have allowed an attacker to execute arbitrary code. The flaws could compromise confidentiality, integrity, and availability by enabling arbitrary code execution or denial of service.

The affected products include Mozilla Firefox and Thunderbird. Versions initially vulnerable were Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. The vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird ESR 140.9.1.

The CVSS score of 8.1 indicates a high severity. The EPSS score of less than 1% suggests low current exploit prevalence, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote; an attacker could trigger the bugs through malicious web content or email attachments processed by the affected application, as inferred from the nature of memory safety bugs in a browser and mail client. The exploit requires no special prerequisites beyond the ability to deliver content to the victim's machine.