CVE-2026-6785 encompasses multiple memory safety bugs in Mozilla Firefox and Thunderbird products, specifically in Firefox ESR 115.34, ESR 140.9, Firefox 149, and Thunderbird 149. These vulnerabilities include use-after-free, uninitialized memory, and incorrect boundary conditions, which have been observed to cause memory corruption. The Mozilla security advisories confirm these issues and state that with sufficient effort, exploitation could lead to arbitrary code execution. The vulnerabilities were addressed and fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. The CVSS v3.1 base score is 7.5, indicating a high severity level. No known exploits in the wild have been reported at the time of publication. The vendor advisories provide detailed references and confirm the availability of patches.

The vulnerabilities can lead to memory corruption, which may be exploited to execute arbitrary code remotely without privileges and with user interaction. The impact includes potential confidentiality, integrity, and availability compromises. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

A fix is available and users should upgrade to Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, or Thunderbird 140.10 as appropriate. The vendor advisories linked provide official patches and detailed remediation information. No additional mitigation steps are required beyond applying these updates.