This vulnerability involves memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1, which showed evidence of memory corruption. Such bugs fall under CWE-125 (Out-of-bounds Read) and CWE-787 (Out-of-bounds Write). Mozilla presumes that with sufficient effort, these bugs could be exploited to run arbitrary code. The issues were addressed and fixed in Firefox 149.0.2 and Thunderbird 149.0.2. The CVSS v3.1 base score is 8.1, indicating high severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and recommends updating to the patched versions.

Successful exploitation of these memory safety bugs could allow an attacker to execute arbitrary code remotely without requiring user interaction or privileges. This could lead to full compromise of the affected Firefox or Thunderbird application, impacting confidentiality, integrity, and availability of the system running the vulnerable software. However, no known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 149.0.2 and Thunderbird 149.0.2. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these versions, no additional mitigation steps are required beyond applying the official update.