Incorrect boundary conditions in the JavaScript Engine component can allow the engine to read or write memory outside of intended bounds when processing JavaScript code. The effect is undefined behavior, which may manifest as crashes, data corruption, or the opportunity for a malicious actor to trigger arbitrary code execution by feeding malformed scripts into the engine.

The vulnerability affects Mozilla Firefox on all platforms that use the default JavaScript engine. Versions up to and including Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are vulnerable. Mozilla Thunderbird is also impacted; all installations of Thunderbird versions 158 and 153.5 contain the flaw. Mozilla’s security advisories for these release lines provide additional context and release notes for the fix.

The CVSS score of 8.1 indicates high severity, while the EPSS score of < 1% reflects a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector would involve delivering crafted JavaScript to a user’s browser or Thunderbird client—through malicious web pages, phishing emails, or other phishing vectors that embed malicious code. Though no public exploits have been reported, the memory corruption flaw presents a classic class of bugs that could be leveraged for more severe compromises if an attacker gains a foothold in the JavaScript execution context.