Memory corruption bugs were present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs could, with sufficient effort, allow an attacker to execute arbitrary code. The result would compromise confidentiality, integrity, and availability, posing a remote code execution risk. This is a typical out‑of‑bounds write flaw (CWE‑787).

Mozilla’s Firefox and Thunderbird browsers were affected, specifically version 149.0.1 of each product. The bug was fixed in version 149.0.2 and later releases, so users with earlier versions remain at risk.

The vulnerability has a high severity CVSS score of 8.1, but an EPSS score below 1 % suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the NIST Known Exploited Vulnerabilities catalog. Based on the description, the attack vector appears to involve exploitation of user‑supplied content processed by the browser or email client, requiring advanced techniques to achieve code execution.