This vulnerability involves multiple memory safety bugs in Mozilla Firefox and Thunderbird versions prior to Firefox 135 and Thunderbird 135, including ESR versions 128.6 and 128.7. The bugs include use-after-free and other memory corruption issues that could allow an attacker to execute arbitrary code with no privileges required and no user interaction. The vulnerabilities were identified and fixed by the Mozilla Fuzzing Team and external researchers. The fixes are included in Firefox 135, Firefox ESR 128.7, Thunderbird 135, and Thunderbird 128.7 releases.

Successful exploitation of these memory safety bugs could allow remote attackers to execute arbitrary code on affected systems without user interaction or privileges, potentially leading to full compromise of the affected application. The CVSS score of 9.8 reflects high impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild at this time.

Mozilla has released official patches fixing these vulnerabilities in Firefox 135, Firefox ESR 128.7, Thunderbird 135, and Thunderbird 128.7. Users and administrators should update to these fixed versions immediately to mitigate the risk. Since this is not a cloud service, patching the client software is required. No additional mitigations are indicated by the vendor advisory.