Mozilla’s JavaScript garbage collector contains an incorrect boundary check that can cause an out‑of‑bounds read (CWE‑125) or buffer under‑read (CWE‑754). An attacker who can cause the garbage collector to process crafted data may trigger a crash in the rendering or email process, leading to a denial of service and potential loss of availability for the affected user. The vulnerability does not enable code execution or data disclosure, but the stability impact of a crash is significant for the application’s user experience.

The flaw affects Mozilla Firefox and Thunderbird, impacting all releases up to but not including Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3. Systems running any prior versions remain vulnerable while those on the specified or newer updates are safe.

The CVSS score of 6.5 marks this as moderate severity. The EPSS score of less than 1 % indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require the attacker to inject malicious JavaScript that the client machine processes, so the attack vector is reasonably limited to local or remote contexts where the user can run arbitrary script. Because no remote code execution component is present, the risk to confidentiality or integrity is low, but the availability impact warrants timely remediation.