Incorrect boundary checks in Firefox's JavaScript engine allow scripts to read or write beyond intended memory boundaries, potentially causing memory corruption that can crash the browser or degrade stability, effectively delivering a denial‑of‑service attack. The description does not state that arbitrary code execution is possible, so the impact is limited to disruption.

Mozilla Firefox versions older than 158, as well as the ESR 115.43 and ESR 153.5 releases, and Mozilla Thunderbird versions older than 158, along with ESR 115.43 and ESR 153.5, are vulnerable until upgraded.

The CVSS score of 8.1 indicates high severity, but the EPSS score of <1% suggests a low exploitation probability and the vulnerability is not listed in the CISA KEV catalog. An attacker who can supply malicious JavaScript—such as from a compromised web page or phishing site—might trigger the buffer overflow and crash the browser. The stated impact is denial of service; no proof of code execution is provided, so the primary risk is disruption rather than privilege escalation or data theft.