The vulnerability involves an invalid pointer in the Nimbus Desktop Client component of Mozilla Firefox, which can lead to undefined behavior such as a crash or potential code execution. The bug allows malicious content to cause the application to dereference a memory address that is no longer valid, a form of memory corruption.

Mozilla Firefox versions prior to 159 and the ESR 153.6 release are affected. Users running older browser releases are at risk until they upgrade to these fixed versions or later.

Official advisories have fixed the issue in Firefox 159 and ESR 153.6, and there are no publicly available exploits or reported incidents, so the EPSS score is not available and the vulnerability is not in the CISA KEV catalog. Because the weakness is an invalid pointer dereference, the attack would likely require the browser to parse malicious content, making it less likely to be remotely exploitable without user interaction. Nonetheless, patching remains the best defense.