This vulnerability consists of multiple memory safety bugs in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. Some bugs showed evidence of memory corruption, which could have allowed attackers to execute arbitrary code with no privileges or user interaction required. Mozilla addressed these issues by releasing fixed versions Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. The CVSS 3.1 base score is 9.8, reflecting critical impact and ease of exploitation over the network. The vendor advisory lists numerous related bugs and confirms the fixes in the stated versions.

Successful exploitation could lead to arbitrary code execution, compromising confidentiality, integrity, and availability of affected systems. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous. There are no known exploits in the wild at the time of the advisory, but the potential impact is critical.

A fix is available and users should upgrade to Firefox 148 or Firefox ESR 140.8, and Thunderbird 148 or Thunderbird ESR 140.8 to mitigate this vulnerability. The vendor advisory confirms these versions contain the official fixes. No additional mitigation steps are required beyond applying the official updates.