JIT miscompilation within the JavaScript: WebAssembly component can cause the just-in-time compiler to generate incorrect machine code for WebAssembly modules. According to the CVE description, the flaw may enable the execution of unintended instructions. This scenario could lead to execution of untrusted code; however, the CVE entry does not explicitly state arbitrary execution, so the exact impact is inferred from the nature of JIT miscompilations.

Mozilla Firefox and Thunderbird installations running versions earlier than 158 (or ESR releases earlier than 153.5) are affected. The flaw was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird ESR 153.5. Users on older versions remain vulnerable.

With a CVSS score of 7.1, the vulnerability is classified as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation, and it has not been listed in the CISA KEV catalog. The most likely attack vector involves the delivery of malicious WebAssembly code through a compromised or malicious web page, which would be compiled incorrectly by the vulnerable JIT engine. While no public exploits have been reported, the high CVSS score underscores the seriousness of the flaw should an exploit become available.