This flaw arises from a weakness in the file handling code that allows an attacker to bypass security mitigations, which could enable the execution of arbitrary code or other privileged actions. The vulnerability is rooted in improper input validation and access control within the file handling component. It has been addressed in later releases.

Mozilla Firefox versions released before 158, as well as the Firefox ESR line before 153.5, and Mozilla Thunderbird versions before 158 (including the ESR 153.5 line), are affected. Users on these builds are vulnerable until they upgrade to a patched release.

The EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog, so publicly known exploitation is uncertain. The CVSS score of 5.4 indicates moderate severity. The likely attack vector is inferred to involve malicious or crafted files presented to a user of a vulnerable Firefox installation, either through browsing or file downloading. With this vector, an attacker could bypass built‑in sandbox or other mitigation mechanisms, elevating the risk of code execution or privilege escalation. Without a publicly known exploit, the probability of attack remains low to moderate, but the potential impact warrants prompt remediation.