Undefined behavior is present within the DOM Streams component in Mozilla Firefox and Thunderbird. The vulnerability could lead to memory corruption, crashes, or other forms of instability. Based on the description, it is inferred that an attacker might trigger such effects by delivering malicious content through streams or web pages rendered by the browser.

Mozilla Firefox and Thunderbird builds preceding the fixes are affected. The specific vulnerable releases are Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, Firefox 157, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. All versions newer than these contain the remediation and are considered safe.

The CVSS score of 8.1 indicates a high severity of the flaw. The EPSS score of < 1% implies a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. No public exploitation or proof‑of‑concept attacks have been documented. Based on the component affected, the likely attack vector is a malicious web page or stream content that could trigger the undefined behavior, but the actual exploitation path is not explicitly described in the advisory. Overall, the risk remains low due to the scarcity of exploitation data, yet the high severity warrants prompt remediation.