An invalid pointer usage in the JavaScript Engine’s JIT component can allow an attacker to write or read memory beyond intended bounds. When an attacker delivers malicious JavaScript, the flaw can be invoked to corrupt program state, potentially leading to arbitrary code execution. The weakness is a classic pointer misuse vulnerable to use‑after‑free or null‑pointer dereference scenarios.

Mozilla Firefox versions prior to 159 and the ESR 153.6 branch are affected. The vulnerability was corrected in Firefox 159 and Firefox ESR 153.6, so any release earlier than those is susceptible.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, a successful exploitation would likely come from a malicious or compromised web page and could execute code with the privileges of the user. Because the flaw impacts the core engine, the risk is moderate to high for users who visit untrusted sites until they update. Once the website is patched, the vulnerability cannot be exploited.