This vulnerability involves memory safety bugs in Firefox ESR 115.26, 128.13, 140.1, Firefox 141, Thunderbird ESR 128.13, 140.1, and Thunderbird 141. Some bugs showed evidence of memory corruption, which could be leveraged to run arbitrary code with sufficient effort. The CVSS score is 8.1, indicating high impact with network attack vector, high complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. Mozilla fixed these issues in Firefox 142, Firefox ESR 115.27, 128.14, 140.2, Thunderbird 142, and corresponding ESR versions. The vendor advisory confirms the fixes and does not report active exploitation.

Successful exploitation could allow an attacker to execute arbitrary code remotely without user interaction or privileges, potentially compromising confidentiality, integrity, and availability of affected systems running vulnerable Firefox or Thunderbird versions. The vulnerability affects multiple ESR and standard releases prior to the fixed versions. No known exploits in the wild have been reported.

Mozilla has released official fixes for this vulnerability in Firefox 142, Firefox ESR 115.27, 128.14, 140.2, Thunderbird 142, and corresponding ESR versions. Users and administrators should update to these fixed versions immediately to mitigate the risk. Since this is not a cloud service, remediation depends on applying these vendor-provided patches. Patch status is confirmed by the vendor advisory.