On arm64 platforms a WebAssembly br_table instruction containing many entries can cause the destination label to be truncated, leading to an incorrect computation of the branch target address. This flaw may allow arbitrary execution of unintended code paths within the WebAssembly runtime, potentially exposing the host system to code execution. The vulnerability is quantified by a CVSS score of 9.8, indicating a severe exploit potential.

Mozilla Firefox and Thunderbird on arm64 platforms are affected. The issue has been fixed in Firefox 141, Firefox ESR 115.26, 128.13 and 140.1, and in Thunderbird 141, 128.13 and 140.1, as noted in the product release notes. Systems running earlier revisions of these browsers on arm64 hardware are vulnerable.

The extremely high CVSS score indicates a serious risk, but the EPSS score of less than 1% suggests that exploitation is currently low probability. The vulnerability is not yet listed in the CISA KEV catalog. An attacker would likely need to supply malicious WebAssembly code to a victim’s browser or email client, making remote user interaction a probable requirement. The precise attack path is inferred from the description, as the note does not detail a publicly documented exploit method.