This vulnerability involves multiple memory safety bugs in Mozilla Firefox and Thunderbird versions prior to Firefox 137 and Thunderbird 137, including ESR 128.8 versions. The bugs show signs of memory corruption, which under sufficient attacker effort could lead to arbitrary code execution. Mozilla has addressed these issues with official fixes in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9. The CVSS 3.1 score is 8.1, indicating a high impact with network attack vector, high complexity, no privileges required, and no user interaction needed. The vendor advisories (MFSA 2025-20 and MFSA 2025-22) provide detailed information and confirm the availability of patches.

Successful exploitation of these memory safety bugs could allow an attacker to execute arbitrary code remotely without requiring user interaction or privileges, potentially leading to full compromise of the affected application. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability. However, no active exploitation in the wild has been reported at this time.

Mozilla has released official patches that fix these vulnerabilities in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9. Users and administrators should update to these fixed versions to remediate the risk. Since the vulnerabilities are patched, no additional mitigation steps are required beyond applying these updates.