Multiple memory safety bugs, including use-after-free vulnerabilities, were identified in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. These bugs showed evidence of memory corruption and could have been exploited to run arbitrary code. Mozilla fixed these vulnerabilities in Firefox 135, Thunderbird 135, Firefox ESR 115.20, and Firefox ESR 128.7. The vulnerabilities are part of a broader set of security issues addressed in Mozilla Security Advisories MFSA 2025-07 and MFSA 2025-08. The CVSS v3.1 base score is 9.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no required privileges or user interaction.

Successful exploitation of these memory safety bugs could allow remote attackers to execute arbitrary code on affected systems, potentially leading to full compromise of the affected Firefox or Thunderbird applications. The vulnerabilities impact confidentiality, integrity, and availability of the affected products. No known active exploitation has been reported at this time.

Mozilla has released official fixes for these vulnerabilities in Firefox 135, Thunderbird 135, Firefox ESR 115.20, and Firefox ESR 128.7. Users and administrators should update to these versions or later to mitigate the risk. Patch status is confirmed as fixed by the vendor advisories MFSA 2025-07 and MFSA 2025-08. No additional mitigation actions are required beyond applying these updates.