When the method String.toUpperCase() expands a string’s length, the resulting string can contain portions of memory that were never initialized, exposing potentially sensitive data. This flaw is classified as uninitialized memory read and buffer misuse (CWE-824, CWE-908). The assessment reflects a CVSS score of 9.8. The vulnerability allows an attacker to retrieve arbitrary data from memory through the manipulated string.

Mozilla Firefox and Mozilla Thunderbird are affected before version 136. Any installation of these products running a version earlier than 136 is vulnerable. Versions 136 and later contain the mitigation and are not impacted.

The EPSS score of "< 1%" implies a very low historical exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The attack path depends on gaining the ability to trigger a locale‑aware uppercase operation, which may arise from malicious web content, local scripts, or extensions. While the documentation does not specify the exact vector, it is reasonable to infer that the flaw can be exercised in both local and remote contexts where the application processes user‑supplied strings. The combination of a high CVSS score and low exploitation likelihood suggests a moderate to high risk that should be addressed promptly.