This vulnerability is a memory safety bug classified under CWE-787, present in Firefox ESR 128.10 and Thunderbird 128.10. It involves memory corruption that, with sufficient effort, could allow arbitrary code execution. Mozilla addressed this issue by releasing Firefox ESR 128.11 and Thunderbird 128.11, which contain the fix. The CVSS v3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a high-severity remote vulnerability requiring high attack complexity and no privileges or user interaction. The vendor advisory explicitly states the fix and provides references to the patched versions.

If exploited, this vulnerability could allow an attacker to execute arbitrary code remotely without requiring user interaction or privileges. The impact includes full confidentiality, integrity, and availability compromise of the affected applications. However, no known exploits are reported in the wild at this time.

An official fix is available and has been released by Mozilla in Firefox ESR 128.11 and Thunderbird 128.11. Users and administrators should update to these versions or later to remediate this vulnerability. No additional mitigation actions are required beyond applying the official update.