This vulnerability involves multiple memory safety bugs in Mozilla Firefox and Thunderbird versions prior to Firefox 139 and Thunderbird 139, including ESR versions 128.10. The bugs include evidence of memory corruption, which could allow an attacker to execute arbitrary code if exploited. The issues were identified by the Mozilla Fuzzing Team and others. Mozilla released official fixes in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction for exploitation.

Successful exploitation of these memory safety bugs could lead to arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected systems. The vulnerabilities affect widely used Mozilla products, potentially impacting users running the specified vulnerable versions. No active exploits have been reported, but the severity and nature of the bugs indicate a significant risk if left unpatched.

Mozilla has released official patches fixing these vulnerabilities in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11. Users and administrators should update to these fixed versions immediately to mitigate the risk. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the vendor advisory.