Multiple memory safety bugs were identified in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140, and Thunderbird 140. These bugs showed evidence of memory corruption and could potentially allow arbitrary code execution if exploited. Mozilla fixed these vulnerabilities in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, Thunderbird ESR 140.1, and Thunderbird 140.1. The vulnerabilities are categorized under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The vendor advisory confirms the fixes and provides detailed information on the affected versions and remediation.

The vulnerabilities could lead to arbitrary code execution due to memory corruption, impacting confidentiality, integrity, and availability of affected systems. The CVSS score of 8.8 reflects a high severity level with network attack vector and no privileges required, although user interaction is necessary. No known exploits in the wild have been reported, reducing immediate risk but the potential impact remains significant if exploited.

Official fixes are available and have been released by Mozilla in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird ESR 128.13, Thunderbird ESR 140.1, and Thunderbird 140.1. Users and administrators should update affected Firefox and Thunderbird installations to these fixed versions or later to mitigate the vulnerabilities. Patch status is confirmed by the vendor advisory. No additional mitigation actions are required beyond applying the official updates.