Incorrect boundary conditions in the Layout component can cause a browser or email client to miscalculate layout information, resulting in crashes or other undefined behavior when rendering affected content. The weakness involves flawed boundary validation, a pattern captured by CWE‑119.

All installations of Mozilla Firefox older than version 158, as well as Firefox ESR 115.43 and ESR 153.5 releases before those specific versions, are vulnerable. The same applies to Mozilla Thunderbird versions older than 158 and Thunderbird ESR 153.5, across all supported platforms.

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests that active exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. Typically, a malicious web page or email attachment that triggers the faulty layout calculations could lead to a crash, providing an attacker with a denial‑of‑service vector. No public exploits have been reported yet, but the high severity rating and the lack of mitigation across legacy installations means that upgrading is the most effective response.