The vulnerability allows an attacker to trigger undefined behavior during XPath parsing by accessing attributes without proper null checks, resulting in an out-of-bounds read. This can lead to memory corruption, which in turn may compromise the integrity of the process and could weaken availability depending on the context of the parsed document.

Mozilla’s Firefox browser and Thunderbird mail client are affected, specifically all versions prior to Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10. The defect is limited to the XPath parsing component within these products.

The CVSS score of 4.8 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the nature of the flaw, the likely attack vector involves delivering a malicious XML document that is parsed by the affected software, either locally or potentially over a network if the application processes external XML content.