This vulnerability involves multiple memory safety bugs in specific versions of Mozilla Firefox and Thunderbird, which could lead to memory corruption and potentially arbitrary code execution. The affected versions include Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0, and Thunderbird 150.0.0. Mozilla released fixes for these issues in Firefox 150.0.1 and Firefox ESR 140.10.1, as documented in their security advisories MFSA2026-35 and MFSA2026-36. The advisories indicate a high to critical impact and confirm that the vulnerabilities have been addressed.

The vulnerabilities could allow an attacker to exploit memory corruption bugs to execute arbitrary code on affected systems. This represents a high to critical security risk, as arbitrary code execution can lead to full compromise of the affected application and potentially the underlying system. However, there are no reports of active exploitation in the wild at this time.

Mozilla has released official patches that fix these vulnerabilities in Firefox 150.0.1 and Firefox ESR 140.10.1. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to mitigate the risk. No additional mitigation steps are required beyond applying these updates.