The bug in the engine incorrectly handled closed generators, enabling an attacker to resume a closed generator and trigger a null pointer dereference, causing the browser or email client to crash. This flaw is a classic null pointer dereference (CWE‑476).

Mozilla Firefox versions up to 140 and all releases before 141 are vulnerable, as are the ESR builds 115.26, 128.13, and 140.1. Mozilla Thunderbird versions up to 140 and the ESR builds 128.13 and 140.1 are also impacted.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1% shows a very low exploitation probability. The flaw requires JavaScript execution in a web page or email, so the attack vector is likely local or via malicious content rather than remote code execution. It is not listed in the CISA KEV. The primary consequence is a denial of service; an attacker could force a user to close the application or launch subsequent denial attacks, provided the generator is closed and then resumed through crafted scripts.