The CVE reports incorrect boundary conditions in the Just‑In‑Time (JIT) component of Mozilla’s JavaScript Engine. The flaw can lead the JIT compiler to write beyond the bounds of an internal buffer during code generation. While the description does not explicitly state exploitation, the nature of the defect and its classification as a buffer overflow (CWE‑119) strongly suggests that malicious JavaScript could trigger memory corruption that may allow arbitrary code execution within the browser or email client process.

The vulnerability affects Mozilla Firefox versions released prior to Firefox 157 and Firefox ESR 153.4, and Mozilla Thunderbird versions released prior to Thunderbird 157 and Thunderbird 153.4. All builds that include the default JIT compiler configuration before the mentioned patch releases remain exposed.

The CVSS score of 8.8 indicates a high‑severity flaw, yet the EPSS score is listed as less than 1 %, implying a very low likelihood of exploitation in the wild. The vulnerability is not catalogued in the CISA KEV list. It is inferred that the likely attack vector would involve a malicious or compromised web page or email that executes JavaScript in a user’s browser or email client; the JIT bug, if triggered, could lead to local code execution.