Internally discovered bugs in specific Thunderbird and Firefox builds involve memory corruption or other serious defects. These bugs affect code paths that process untrusted data, such as email messages or web content, leading to potential buffer overrun and memory overwrite (CWE‑119, CWE‑787). With sufficient effort, an attacker could trigger the memory corruption to cause the application to execute arbitrary code or elevate privileges on the host. These vulnerabilities were remedied in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mozilla Firefox and Mozilla Thunderbird product lines are impacted. Specific vulnerable builds include Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153. The fixes were delivered in Thunderbird 140.14, Thunderbird 153.1, and Thunderbird 154; Firefox builds v154, ESR 115.39, ESR 140.14, and ESR 153.1 contain the remediation. Any earlier versions of these products not yet patched may remain vulnerable.

The CVSS score of 9.8 indicates a severe security flaw, while the EPSS score of less than 1% reflects a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through processing of external input such as email attachments or headers handled by Thunderbird, or similarly untrusted web content in Firefox. Exploitation would require an attacker to supply crafted data that triggers the memory corruption, prompting a custom zero‑day effort and likely local code execution or privilege escalation on the victim system.