This vulnerability involves multiple memory safety bugs in Mozilla Firefox and Thunderbird versions prior to Firefox 138 and ESR 128.10. The bugs include evidence of memory corruption, which under certain conditions could allow an attacker to execute arbitrary code. These issues were addressed and fixed in the subsequent releases Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vendor advisory explicitly states the fixes and provides references to the bugs and patches.

Successful exploitation of these memory safety bugs could lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected systems. However, there are no known exploits in the wild at this time. The impact is rated high due to the potential severity of arbitrary code execution.

Official patches addressing these vulnerabilities have been released in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. Users and administrators should update to these versions or later to remediate the vulnerabilities. Patch status is confirmed by the Mozilla vendor advisory. No additional mitigation actions are required beyond applying the official updates.