The flaw is a use‑after‑free in the Storage: IndexedDB component. The bug occurs when a database operation references an object that has already been deallocated, creating a window for memory corruption. While the CVE description does not detail an exploit resulting in code execution, the corrupted memory could lead to integrity violations or crashes within the browser process.

Mozilla Firefox releases before ESR 153.4, ESR 115.42, ESR 140.17 and before the 157 stable release are vulnerable. Mozilla Thunderbird releases prior to 140.17, 153.4, and 157 carry the same weakness. Applying the patched versions listed in the CVE description removes the vulnerability in both products.

The CVSS score of 8.8 classifies the issue as high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not recorded in the CISA KEV catalog. Because the CVE description does not specify how a threat actor could trigger the use‑after‑free, the precise attack vector remains undefined in the data; available information does not confirm whether local or remote content is required.