Memory safety bugs were present in Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and the developers presume that with sufficiently effort they could be exploited to run arbitrary code. The vulnerability was fixed in Thunderbird 150.0.2 and Firefox 150.0.2.

Mozilla Thunderbird 150.0.1 is affected by memory safety bugs that could allow arbitrary code execution. The issue was resolved in version 150.0.2. No other affected releases are explicitly cited on the provided data.

The CVSS score is 8.1, indicating a high severity. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known public exploits. The likely attack vector involves an attacker delivering crafted content such as malicious email attachments or other exploitative messages that trigger Thunderbird's memory corruption, allowing an attacker to gain arbitrary code execution in the Thunderbird process and potentially compromise the host system.