An inconsistent comparator in the Firefox XSLT sorter component (xslt/txNodeSorter) can cause an out‑of‑bounds read when processing certain XSLT files. The weakness is a classic out‑of‑bounds memory read (CWE‑125) that may lead to memory corruption or crash, potentially enabling further exploitation. Firefox and Thunderbird use the same XSLT engine, so the issue applies to both products.

Affected installations are Mozilla Firefox versions 122 through 135 and the corresponding ESR builds below 128.8, as well as Mozilla Thunderbird versions 122 through 135 and its ESR releases below 128.8. Versions 136 and newer, or ESR 128.8 and newer, contain the patch that replaces the flawed comparator logic with a safe implementation.

The vulnerability scores a CVSS base of 8.1, indicating a high‑severity issue with substantial impact. The EPSS score is reported as less than 1%, suggesting that widespread exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog, which further indicates that it has not been observed in the wild in large‑scale attacks. The likely attack vector involves an attacker supplying a malicious XSLT file or payload that triggers the sorting routine. Given the low EPSS and absence of public exploitation, organizations should promptly update or restrict XSLT usage until the patch is applied.