This vulnerability is a use‑after‑free bug in the Inter‑Process Communication (IPC) component of Mozilla products. The flaw can allow an attacker to read or write arbitrary memory, potentially leading to remote code execution on the affected system. It is classified as CWE‑416, reflecting an application weakness where a program uses memory after it has been freed. The vulnerability was discovered and later fixed in the specified product releases.

The flaw affects Mozilla Firefox and Thunderbird. For Firefox, the vulnerability is fixed in Firefox 147, Firefox ESR 115.32 and ESR 140.7. For Thunderbird, it is fixed in Thunderbird 147 and Thunderbird 140.7. Users running earlier releases of these products are exposed to the risk.

The CVSS score is 8.8, indicating high severity. The EPSS score is listed as < 1 %, which signifies a very low but non‑zero probability of exploitation at the time of assessment. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly stated; however, based on the nature of the flaw, it is reasonable to infer that exploitation would require an attacker to interact with the IPC mechanism, potentially through a local or remote process that can trigger the use‑after‑free condition. Given the high impact, the risk is considered significant for systems that have not yet applied the patch.