The vulnerability is a use‑after‑free flaw found in the DOM Core and HTML components of Mozilla Firefox and Thunderbird. The flaw can result in unintended memory access that may lead to unpredictable behavior when malicious content is processed. The high CVSS score indicates significant potential impact.

Mozilla Firefox and Thunderbird are affected. The issue was resolved in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. Earlier versions of these products are considered vulnerable until verified otherwise.

The CVSS score of 8.8 reflects high severity, and the EPSS score of <1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector appears to involve malicious web content accessed by the browser, but this is inferred because the CVE description does not provide explicit details.