An attacker can cause an out-of-bounds read or write on a JavaScript object by confusing array index sizes, potentially corrupting memory. This flaw could allow the attacker to read sensitive data, alter program state, or crash an affected browser. The weakness is documented as CWE‑125 and CWE‑787.

Mozilla Firefox versions up to and including 138.0, and Firefox ESR releases older than 128.10.1 and 115.23.1, are affected. Mozilla Thunderbird versions up to and including 138.0.2, and Thunderbird ESR releases older than 128.10.2, are also vulnerable. Packages that embed these browsers on Red Hat Enterprise Linux and derivatives, as listed in the provided CPEs, fall under the same impact scope.

The CVSS score of 8.8 reflects high severity, while the EPSS score of less than 1 % indicates a very low current exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no widespread active exploitation. Attacks likely require delivery of crafted JavaScript via a web page, meaning the threat is primarily remote but depends on user‑initiated browsing or embedded content.