The updated description indicates that the vulnerability involves memory safety bugs that caused memory corruption in Firefox ESR 140.10.0, Firefox 150.0.0, Thunderbird ESR 140.10.0, and Thunderbird 150.0.0. The description notes that these bugs show evidence of memory corruption and, with sufficient effort, could be exploited to run arbitrary code. The fixes in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1 remove the vulnerable code paths.

Affected versions include Firefox ESR 140.10.0, Firefox 150.0.0, Thunderbird ESR 140.10.0, and Thunderbird 150.0.0. The fix reached Firefox ESR 140.10.1, Firefox 150.0.1, Thunderbird ESR 140.10.1, and Thunderbird 150.0.1.

Memory corruption can lead to remote code execution. The CVSS score is 7.3 and the EPSS score is less than 1%, with the vulnerability not listed in KEV. The likely attack vector is inferred to be via malicious content—such as web pages or email attachments—that the vulnerable software processes, given that memory safety bugs often become exploitable through user interaction with such content. While no public exploit is documented, the potential severity remains high if an attacker can trigger the corrupting code paths.