The vulnerabilities in Thunderbird 140.10 and Thunderbird 150 involve memory corruption bugs that could be exploited to execute arbitrary code if sufficient effort is applied. The description only indicates memory corruption; the specific location (heap or stack) is not specified and remains inferred. Successful exploitation would grant attackers full control over the affected Thunderbird process, compromising confidentiality, integrity, and availability of user data and system resources.

Mozilla Thunderbird with the following releases: Thunderbird 140.10 and Thunderbird 150. These releases were affected by the memory safety bugs described in the CVE. The vulnerabilities were fixed in Thunderbird 140.11 and 151. Although Mozilla Firefox is mentioned in the CVE, no specific affected Firefox versions are listed; the patch was applied in Firefox 151 and Firefox ESR 140.11.

Concrete exploitation details are not disclosed, EPSS not available, and the vulnerability is not listed in the CISA KEV catalog. Because the bugs are classic memory corruption that could lead to arbitrary code execution, the CVSS score of 9.8 indicates a critical severity. Based on the description, it is inferred that the attack vector could involve specially crafted email content, such as attachments or HTML emails that Thunderbird processes, triggering the memory corruption.