Multiple memory safety bugs were identified in various Mozilla products including Firefox 135 and Thunderbird 135 series, as well as their ESR counterparts. These bugs involve memory corruption that could allow an attacker to execute arbitrary code with user interaction. The vulnerabilities were addressed and fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8. The CVSS 3.1 score of 7.5 reflects a high severity with network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The Mozilla advisories provide detailed descriptions and confirm the fixes.

Successful exploitation of these memory safety bugs could allow an attacker to execute arbitrary code within the context of the affected application, potentially leading to compromise of user data, application integrity, and availability. The vulnerabilities require user interaction and have high complexity, reducing the likelihood of widespread exploitation. No active exploits have been reported in the wild at this time.

Official fixes for these vulnerabilities are available and have been released in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8. Users and administrators should update to these versions or later to mitigate the risk. Since these are client applications, patching is the primary mitigation. No additional vendor-recommended mitigations or workarounds are indicated in the advisory.