CVE-2026-6785 encompasses multiple memory safety bugs affecting various Mozilla products including Firefox ESR 115.34, ESR 140.9, Thunderbird ESR 140.9, Firefox 149, and Thunderbird 149. These bugs involve use-after-free, uninitialized memory, and incorrect boundary conditions, which can lead to memory corruption. The vulnerabilities were assessed with a high impact on confidentiality, integrity, and availability (CVSS 7.5) and could potentially allow arbitrary code execution if exploited. Mozilla released official fixes in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The vendor advisories provide detailed references and confirm the remediation status.

The vulnerabilities pose a high risk due to memory corruption that could be leveraged to execute arbitrary code, potentially compromising system confidentiality, integrity, and availability. However, there are no reports of active exploitation in the wild. The affected versions include widely used Firefox ESR and Thunderbird versions prior to the fixed releases.

Official patches addressing these vulnerabilities have been released by Mozilla in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these fixed versions to remediate the vulnerabilities. Since the vendor has provided official fixes, applying these updates is the recommended and sufficient mitigation.