CVE-2025-6436 addresses memory safety bugs in Firefox 139 and Thunderbird 139, some of which showed evidence of memory corruption. These bugs could potentially allow an attacker to execute arbitrary code with no privileges and no user interaction required, as indicated by the CVSS vector (AV:N/AC:H/PR:N/UI:N). Mozilla released fixes for these issues in Firefox 140 and Thunderbird 140. The vulnerability is categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vendor advisory details that these flaws were fixed and no exploits are known in the wild.

The vulnerability could allow remote attackers to execute arbitrary code on affected systems running Firefox 139 or Thunderbird 139 due to memory corruption issues. This could lead to full compromise of the affected application. However, no active exploitation has been observed. The impact is rated high with a CVSS score of 8.1, reflecting the potential for confidentiality, integrity, and availability impacts.

Mozilla has released official fixes for this vulnerability in Firefox 140 and Thunderbird 140. Users and administrators should upgrade to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is mitigated by other means. Patch status is confirmed by the vendor advisory.