Memory safety bugs in Firefox 149 and Thunderbird 149 were updated in the description to specify that these bugs involve memory corruption, such as use‑after‑free, double‑free and out‑of bounds writes (CWE‑125, CWE‑416, CWE‑787). The wording still indicates that, with sufficient effort, an attacker could trigger arbitrary code execution, thereby compromising confidentiality, integrity, and availability of the affected system. The likely attack vector remains the processing of external content (web pages, downloads or email), consistent with the original entry, though the exact attack path is not detailed in the CVE.

Mozilla’s Firefox version 149 is affected. The vulnerability was addressed in Firefox 150, which is the earliest safe release. No detailed patch version data was provided beyond this milestone. If Thunderbird users are affected, the corresponding fix is also in version 150, and Thunderbird is included in the official CNA vendor/product list.

The CVSS score of 7.5 indicates a high severity level. EPSS data is not available, so the precise exploitation probability cannot be quantified, but the non‑listing in CISA’s KEV catalog suggests that no active exploitation has been reported yet. Nonetheless, the combination of memory corruption weaknesses and the browser’s privileged execution context poses a significant risk if the vulnerability is exploited.