The vulnerability involves an invalid pointer within Firefox’s JavaScript garbage collector. While the advisory does not specify the precise outcome, the pointer misuse can trigger memory corruption, leading to application crashes or, if exploitable, potential arbitrary code execution. The updated description does not affect the assessment of the vulnerability’s impact.

The affected product is Mozilla Firefox and Mozilla Thunderbird. All releases prior to version 159 are potentially impacted. Because the advisory does not list a precise version range, users should assume any pre‑159 version may contain the issue.

The CVSS score is not provided and the EPSS score is unavailable, so the exact risk level is uncertain. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation is documented. The likely attack vector would be the delivery of malicious JavaScript via the web; an attacker could trigger the garbage‑collector to dereference an invalid pointer, potentially causing a denial‑of‑service or, in a worst‑case scenario, local code execution. Because the patch is already available, updating mitigates the primary risk.