Memory safety bugs were discovered in Thunderbird 150. These bugs showed evidence of memory corruption and could potentially allow arbitrary code execution with sufficient effort. The weaknesses involve buffer overrun or buffer‑access‑after‑free errors (CWE‑119, CWE‑787).

Mozilla Thunderbird version 150 is affected. The bug was resolved in Thunderbird 151, and the same fix was applied to Firefox 151, although no direct evidence of a Firefox 150 affected state is provided in the description.

The EPSS score of <1% indicates a very low but nonzero chance of exploitation, while the CVSS score of 8.8 reflects high severity. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker crafting malicious email content – such as a malformed attachment or message body – that, when processed by Thunderbird 150, triggers the vulnerable memory handling code, potentially enabling unprivileged code execution within the Thunderbird process.