This flaw arises from a race condition that can cause a use‑after‑free inside the DOM File component of Firefox and Thunderbird. The bug can corrupt memory, and like other use‑after‑free bugs it can be leveraged to achieve arbitrary code execution or to crash the affected application. The CVE entry does not explicitly list the consequences, so the impact is inferred from the nature of use‑after‑free vulnerabilities.

All Mozilla Firefox releases before version 159 and all Mozilla Thunderbird releases before version 159 are vulnerable. The fix was deployed in Firefox 159 and Thunderbird 159, so any installation with Firefox 158 or Thunderbird 158 or earlier remains affected until updated to a patched build.

No CVSS or EPSS score is supplied, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw potentially allows arbitrary code execution and affects many older releases, the overall risk can be considered moderate to high until the issue is patched. The potential exploitation path would require triggering the race condition, which likely entails manipulating file operations through a malicious web page or content, but the exact attack vector is not fully described in the CVE data.