This vulnerability consists of memory safety bugs in Firefox 133 and Thunderbird 133, some of which showed evidence of memory corruption. With sufficient effort, these bugs could have been exploited to run arbitrary code. The issues were addressed and fixed in Firefox 134 and Thunderbird 134. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability. The vendor advisories from Mozilla confirm the patches and provide detailed information on the fixes.

Successful exploitation of these memory safety bugs could allow an attacker to execute arbitrary code remotely without requiring user interaction or privileges, potentially leading to full compromise of the affected application. This impacts confidentiality, integrity, and availability of the system running the vulnerable versions of Firefox or Thunderbird. No known active exploits have been reported.

Mozilla has released official fixes for this vulnerability in Firefox 134 and Thunderbird 134. Users and administrators should upgrade to these versions or later to remediate the issue. Since this is not a cloud service, remediation requires updating the client software. Patch status is confirmed by the vendor advisories at https://www.mozilla.org/security/advisories/mfsa2025-01/ and https://www.mozilla.org/security/advisories/mfsa2025-04/. There are no indications that additional mitigations beyond applying the update are necessary.