On 64‑bit platforms the IonMonkey JavaScript JIT writes only half of the 64‑bit return value onto the stack, while the baseline JIT reads the full 64 bits. This mismatch causes the return value that is read to not match what was written, potentially leading to inconsistent or incorrect behavior during script execution.

The issue affects Mozilla Firefox and Thunderbird running on 64‑bit operating systems. Versions before the security updates are impacted: Firefox 141 and earlier, as well as the Firefox ESR releases 115.26, 128.13, and 140.1; and Thunderbird 141 and earlier, together with the Thunderbird ESR releases 128.13 and 140.1.

The CVSS score of 6.5 indicates moderate severity, and an EPSS score of < 1 % suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Likely attackers would need to inject or execute malicious JavaScript within the browser or mail client to trigger the IonMonkey JIT’s truncated write. No publicly disclosed exploits are available for this issue.