## Summary
Mozilla Firefox and Thunderbird contain a use-after-free in the JavaScript: GC component (CWE-416). The issue is network-reachable and was fixed in Firefox/Thunderbird releases listed by Mozilla.
## Technical Details
- Vulnerability class: CWE-416 (Use After Free)
- Component: JavaScript: GC (Mozilla Bug 2009608)
- Root condition (high level): an object freed by the JavaScript garbage collector is later accessed, leading to memory safety impact.
- Affected code area is tracked under Bug 2009608 and includes attached materials:
- testcase (listed as 1.08 KB, text/plain)
- debug stack (listed as 6.76 KB, text/plain)
## Affected
- mozilla firefox < 115.33.0
- mozilla thunderbird < 140.8.0
- Fixed in (per Mozilla advisory text):
- Firefox 148
- Firefox ESR 115.33
- Firefox ESR 140.8
- Thunderbird 148
- Thunderbird 140.8
## Impact
- CVSS vector provided: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: NETWORK
- Security impact (per NVD summary): memory corruption potential from use-after-free, with confidentiality/integrity/availability impact indicated by the CVSS metrics.
## Mitigation
1. Patch immediately to versions fixed by Mozilla: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8.
2. If patching is delayed, reduce exposure by limiting access to untrusted web content until updates are applied.
3. Monitor for browser crashes or abnormal behavior consistent with memory-safety faults, and prioritize affected endpoints for update.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416