The vulnerability arises from incorrect boundary checks in the DOM-based editor component of Firefox and Thunderbird. The flaw permits a malicious document or web page to supply crafted rich‑text content that can overflow or underflow internal buffers, potentially leading to memory corruption. While the CVE text does not explicitly confirm code execution, such boundary violations can allow an attacker to trigger arbitrary code execution or a denial‑of‑service condition if they can force the editor to process the malicious input.

All Firefox releases earlier than version 158, including the ESR 153.5 branch, and all Thunderbird releases earlier than version 158, including the ESR 153.5 branch, are affected. These builds expose the editor to malicious rich‑text documents or web pages that could trigger the boundary condition error.

The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1 % shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploitation evidence has been reported. The most probable attack vector is a crafted rich‑text document or web page that loads the editor component with malicious content. The potential for memory corruption warrants immediate remediation.