Mozilla Firefox and Thunderbird Memory Corruption Vulnerability in GMP Component Allowing Sandbox Escape

A memory corruption vulnerability has been identified in the GMP (Gecko Media Plugin) process of Firefox and Thunderbird. This process, which handles encrypted media, is heavily sandboxed but operates with slightly different privileges than the content process. The vulnerability affects multiple versions of Firefox and Thunderbird, prior to 142, as well as several Firefox ESR and Thunderbird ESR versions. The memory corruption could potentially be exploited to escape the sandbox and execute arbitrary code.

Impact

Exploitation of this vulnerability leads to memory corruption, with evidence suggesting that it could be leveraged to run arbitrary code.

Remediation

Users can upgrade to Firefox 142 or Thunderbird 142. Firefox ESR users should upgrade to version 115.27, 128.14 or 140.2, depending on their current version. Thunderbird ESR users should upgrade to 128.14 or 140.2.