Memory safety bugs were discovered in Mozilla Thunderbird 150.0.0 that caused memory corruption, and the proof‑of‑concept evidence suggests that with enough effort they could be leveraged to execute arbitrary code. The weakness is a classic buffer overrun scenario (CWE‑119) that can corrupt memory and potentially allow code execution if an attacker can deliver a crafted payload into the application.

Both Mozilla Thunderbird and Mozilla Firefox version 150.0.0 are affected; the product updates to 150.0.1 contain the fix. The CVE does not list later minor releases, so any configuration using exactly 150.0.0 of either product requires remediation.

The CVSS score of 7.3 indicates a high severity vulnerability, while the EPSS score of less than 1% shows that exploit attempts are currently rare. The vulnerability is not presently listed in the CISA KEV catalog. An attacker would need to gain sufficient access to Thunderbird or Firefox in order to exploit the memory corruption, but if succeeded it would provide full arbitrary code execution on the host.