This vulnerability involves multiple memory safety bugs in Mozilla Firefox and Thunderbird versions ESR 140.5 and 145. The bugs include memory corruption issues that could allow an attacker to execute arbitrary code if exploited. Mozilla addressed these issues in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. The CVSS v3.1 base score is 8.1, with network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisories MFSA2025-92 and MFSA2025-94 provide detailed information and confirm the availability of official fixes.

Successful exploitation of these memory safety bugs could lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the affected systems. The high CVSS score reflects the serious nature of these vulnerabilities. However, no active exploitation has been observed in the wild according to current data.

Mozilla has released official fixes for these vulnerabilities in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird ESR 140.6. Users and administrators should update to these versions or later to remediate the vulnerabilities. Since official patches are available, applying these updates is the recommended mitigation. There is no indication from the vendor advisory that additional interim mitigations are required.