Memory safety bugs present in Thunderbird 150 could corrupt data in memory; the CVE description notes that some bugs show evidence of memory corruption and are presumed capable of arbitrary code execution with enough effort. The vulnerability is addressed in Thunderbird 151 and Firefox 151.

Mozilla Thunderbird and Mozilla Firefox are affected. The CVE indicates that Thunderbird 150 contains the bugs, and the fix was applied in Thunderbird 151. Exact supported versions beyond these are not detailed in the CVE data.

The EPSS score of <1% suggests a very low but nonzero likelihood of exploitation, and the CVSS score of 8.8 demonstrates high severity. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, a likely attack vector involves an attacker delivering malicious content, such as a crafted email attachment, which, when processed by Thunderbird, would trigger the vulnerable memory handling code, potentially allowing an unprivileged user to execute code with the privileges of the Thunderbird process.