The vulnerability is a use‑after‑free in the DOM Editor component that can corrupt application memory when a user opens or interacts with editor documents containing maliciously crafted data. Faulty memory handling may result in arbitrary code execution or browser crashes.

Users running Mozilla Firefox versions earlier than 159, and Firefox ESR before the 115.44 and 153.6 releases, as well as Mozilla Thunderbird prior to version 159 or ESR 153.6, are affected. The flaw lies in the embedded DOM Editor component used by both products.

The CVE has no published EPSS score and is not listed in the CISA KEV catalog, indicating no known widespread exploitation. The lack of an EPSS score means the exploitation probability is unknown. The vulnerability could be triggered by a crafted web page that loads the vulnerable editor; attackers would primarily target users who visit malicious sites or open malicious email content. Because memory corruption can lead to arbitrary code execution, the potential impact is high but the real‑world exploitation likelihood remains unclear.