Technical impact
Memory safety bugs were identified in older releases of Firefox and Thunderbird that could corrupt memory. The impact is the potential to execute arbitrary code on the affected system, as indicated by the possibility of memory corruption leading to remote code execution. The vulnerabilities are mapped to common weaknesses involving buffer overflows and use‑after‑free errors, allowing an attacker to gain code execution rights.
Affected Systems
Mozilla Firefox and Thunderbird are affected when running ESR 140.9, Thunderbird ESR 140.9, Firefox 149, or Thunderbird 149. The fix is available in Firefox 150, Thunderbird 150, and the ESR 140.10 releases.
Risk and Exploitability
The CVSS score of 7.5 reflects high severity, and the EPSS score of <1% indicates a low but nonzero probability of exploitation. The absence from CISA’s KEV catalog suggests it has not yet been widely exploited. Based on the description, the likely attack vector is through maliciously crafted web content or locally installed data that triggers the memory corruption. The risk is significant for systems that still run the vulnerable versions with unrestricted web or local file access.
Debian DLA
Debian DSA