The vulnerability involves a flaw in the file handling component of Mozilla Firefox and Thunderbird that allows an attacker to bypass existing security mitigations. The flaw is fixed only in both browsers’ ESR 153.5 releases; earlier ESR revisions or other builds lacking the patch may accept malicious file inputs without the intended safety checks. The primary impact is that an attacker could deliver crafted files to a victim’s browser, potentially causing unintended code execution or data compromise. The weakness aligns with input validation problems and improper authentication controls, as indicated by the CWE identifiers.

Mozilla Firefox and Mozilla Thunderbird are affected products. The advisory notes that the vulnerability is fixed in Firefox ESR 153.5 and Thunderbird 153.5, implying that all earlier ESR versions of both browsers remain vulnerable. Users of older Firefox ESR builds or older Thunderbird builds should verify their installed versions or upgrade promptly.

The EPSS score of < 1% indicates a very low exploitation probability; the vulnerability is not listed in CISA’s KEV catalog, so no widely documented exploits are known. The CVSS score of 8.3 indicates high severity. Nevertheless, the flaw provides a pathway for attackers to subvert file handling mitigations in both Firefox and Thunderbird, which could lead to code execution or data compromise. The likely attack vector involves supplying a malicious file to the browser via a webpage, email attachment, or local file.