Memory safety bugs present in Firefox 150 could corrupt data in memory; the CVE description notes that some bugs show evidence of memory corruption and are presumed capable of arbitrary code execution with enough effort. The vulnerability is addressed in Firefox 151 and Thunderbird 151.

Mozilla Thunderbird and Mozilla Firefox are affected. The CVE indicates that Firefox 150 contains the bugs, and the fix was applied in Firefox 151 and Thunderbird 151. Exact supported versions beyond these are not detailed in the CVE data.

The EPSS score of <1% suggests a very low but nonzero likelihood of exploitation, and the CVSS score of 8.8 demonstrates high severity. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, a likely attack vector involves an attacker delivering malicious content, such as a crafted webpage or web content, which, when processed by Firefox, would trigger the vulnerable memory handling code, potentially allowing an unprivileged user to execute code with the privileges of the Firefox process.