The flaw is caused by incorrect boundary checks in the Layout component of Mozilla Firefox and Thunderbird. Based on the description, it is inferred that an attacker could trigger an out‑of‑bounds write by supplying crafted layout data, which could lead to memory corruption, a crash, or denial of service. The advisory does not confirm an exploit, but the nature of the vulnerability suggests these outcomes.

Mozilla Firefox and Thunderbird releases prior to version 158 contain the vulnerable Layout component. All builds that include this component are affected; the issue is not restricted by operating system or processor architecture, and the fix is released uniformly in version 158 of each product.

The EPSS score of <1 % indicates that active exploitation is unlikely at present, but the moderate CVSS score of 5.4 reflects a moderate impact if exploitation were to succeed. The vulnerability is not listed in CISA KEV, suggesting no known active exploits. Based on the description, it is inferred that an attacker could trigger an out‑of‑bounds write by delivering crafted layout data to a user or through a malicious web page. The attack vector would likely involve malicious content processed by the browser. Until an update is applied, the risk remains low to moderate but cannot be dismissed given the potential for memory corruption or denial of service.