CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141 and Thunderbird 141.
AnalysisAI
Memory corruption in Firefox 140 and Thunderbird 140 enables remote code execution without authentication. Mozilla confirmed multiple memory safety bugs with evidence of corruption, collectively presumed exploitable for arbitrary code execution. Fixed in Firefox 141 and Thunderbird 141. CVSS 9.8 critical severity with network-accessible attack vector requiring no user interaction. EPSS data not provided; no public exploit identified at time of analysis.
Technical ContextAI
This vulnerability represents a collection of memory safety bugs (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) affecting the core rendering and processing engines of Mozilla Firefox 140 and Thunderbird 140. Memory safety bugs in browser engines typically involve heap/stack buffer overflows, use-after-free conditions, or type confusion errors in C++ code handling HTML, JavaScript, CSS, or media parsing. The CVSS vector indicates these flaws are exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). Mozilla's acknowledgment that 'some of these bugs showed evidence of memory corruption' and their presumption of exploitability indicates internal security team verification through fuzzing or code analysis. The affected products per CPE data are specifically Mozilla Firefox and Thunderbird desktop applications across all platforms (Windows, macOS, Linux).
RemediationAI
Immediately upgrade to Firefox version 141 or later and Thunderbird version 141 or later, which contain fixes for all identified memory safety bugs. Organizations should deploy these updates through existing software distribution mechanisms with high priority given the critical CVSS rating and remote code execution impact. Mozilla provides official downloads and update channels at mozilla.org. For enterprise environments using Firefox ESR or managed Thunderbird deployments, verify update availability through respective channels and test compatibility before production deployment. No effective workarounds exist for memory corruption vulnerabilities in browser engines; patching is the only reliable mitigation. Until patching is complete, consider network segmentation to limit exposure of critical systems and monitor for unusual browser process behavior. Refer to Mozilla Security Advisories MFSA2025-56 (https://www.mozilla.org/security/advisories/mfsa2025-56/) and MFSA2025-61 (https://www.mozilla.org/security/advisories/mfsa2025-61/) for complete technical details and vendor guidance.
Share
External POC / Exploit Code
Leaving vuln.today