The vulnerability arises when the just‑in‑time compiler for WebAssembly on 64‑bit CPUs wrongly reuses bits from overwritten memory when compiling i32 return values. This can lead to a type confusion that potentially makes a value appear as a different type, creating a memory corruption condition. The impact can compromise confidentiality, integrity, or availability if an attacker manages to trigger the faulty JIT execution flow.

The flaw affects Mozilla Firefox on all releases up to 135, including ESR 115.20 and ESR 128.7, and Mozilla Thunderbird on all releases up to 135, including ESR 128.7. The vulnerability is removed in Firefox 136, ESR 115.21, and ESR 128.8, as well as in Thunderbird 136 and ESR 128.8. The issue applies to 64‑bit architectures running these browsers. Red Hat Enterprise Linux is listed as a potential host for affected binaries.

The CVSS score of 7.6 indicates a high severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation at the time of analysis. The issue is not listed in the CISA KEV catalog. The likely attack vector would involve an attacker delivering malicious WebAssembly code that triggers the JIT compiler error, though the exact exploitation details are not disclosed.