The vulnerability is a use‑after‑free condition that occurs when the software processes a controlled failed memory allocation during text line breaking. An attacker that can induce the failure could trigger the use‑after‑free, potentially leading to a crash and the ability to elevate privilege or execute arbitrary code in a limited manner. The weakness is classified as CWE‑416.

Mozilla products are affected, including Firefox and Thunderbird. Versions prior to Firefox 134 or Firefox ESR 128.6 (and 115.19) and Thunderbird 134 or Thunderbird ESR 128.6 are susceptible. Any distribution that bundles these earlier releases, such as certain Red Hat Enterprise Linux (RHEL) packages, is also at risk until it upgrades to a patched build.

The CVSS score of 5.3 indicates a moderate impact and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or require the attacker to cause a memory allocation failure, which may limit immediate remote exploitation.