An invalid pointer in the JavaScript WebAssembly component can corrupt memory, potentially allowing an attacker to execute arbitrary code. The flaw involves an invalid pointer that can lead to memory corruption, and impacts the integrity of the browser process. With a CVSS score of 9.8, the vulnerability’s effects would undermine the security guarantees of the JavaScript execution environment.

The issue affects Mozilla Firefox versions older than ESR 153.4, version 157, or ESR 140.17, as well as Mozilla Thunderbird versions older than 140.17, 153.4, or 157. Users of these builds are exposed because the pointer misuse is not corrected.

The EPSS score is reported as < 1%, indicating a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 9.8, indicating very high severity. Based on the description, the likely attack vector involves a malicious web page that delivers WebAssembly payloads; however, the exact exploitation steps are not detailed in the advisory, so this inference is made from the limited data available. If an attacker succeeds, the potential impact is high, with possible arbitrary code execution within the browser context.