The CVE describes a use-after-free bug in the JavaScript garbage collector component of Mozilla Firefox and Thunderbird. The flaw can lead to memory corruption and potentially unstable behavior of the JavaScript engine. The advisory labels the issue as a moderate-severity vulnerability, but the vendor does not specify that the bug can be used to execute code or otherwise compromise data integrity or confidentiality.

Mozilla Firefox and Thunderbird are impacted. Versions prior to Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird ESR 140.7 contain the flaw. The security advisories indicate that the vulnerability is fixed in the aforementioned releases and all later builds.

The CVSS score is 6.5, and the EPSS score is less than 1 %, signifying moderate severity but a low probability of exploitation at the time of analysis. The advisory does not list the vulnerability in the CISA KEV catalog. While the exact attack vector is not specified, it is reasonable to infer that an attacker would need to trigger the defect within the JavaScript engine—potentially by serving malicious scripts via a webpage or an email attachment. Successful exploitation would likely result in memory corruption; the impact does not include arbitrary code execution or system compromise per the vendor's description.