This vulnerability consists of memory safety bugs in Firefox 149.0.1 and Thunderbird 149.0.1, some of which showed evidence of memory corruption. The bugs fall under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). Mozilla presumes that with sufficient effort, these bugs could have been exploited to run arbitrary code. The issues were fixed in Firefox 149.0.2 and Thunderbird 149.0.2. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector but requiring high attack complexity and no privileges or user interaction.

Successful exploitation could allow an attacker to execute arbitrary code on affected systems, potentially leading to full compromise of the Firefox or Thunderbird process. The vulnerability affects confidentiality, integrity, and availability of the impacted applications. However, no known exploits have been reported in the wild. The risk is mitigated by the availability of fixed versions.

Mozilla has released official fixes for this vulnerability in Firefox 149.0.2 and Thunderbird 149.0.2. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.