The vulnerability consists of several memory safety bugs that appear in multiple Mozilla browser and email client releases. The bugs produce memory corruption and, with sufficient effort, could allow an attacker to execute arbitrary code. They are categorized as out‑of‑bounds read (CWE‑125), use‑after‑free (CWE‑416), and out‑of‑bounds write (CWE‑787). The bugs were fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Affected products include Mozilla Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. The bugs were fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10, as well as Thunderbird 150.

The CVSS score of 8.1 indicates a high‑severity issue that could enable remote code execution; the EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits yet. Based on the memory corruption nature, the likely attack vector is remote via malicious web page or email content, although local exploitation is theoretically possible with additional conditions. Successful exploitation would allow an attacker to bypass process integrity and run code with the privileges of the affected user or process.