A memory safety bug, specifically an out‑of‑bounds memory operation, was identified in Firefox and Thunderbird and has been fixed in version 152 of each product. The flaw can cause the application to crash, resulting in denial of service. The weakness aligns with CWE‑119 and CWE‑787 and is scored with a CVSS of 5.3.

All installations of Mozilla Firefox and Mozilla Thunderbird earlier than version 152 are vulnerable. The issue was addressed in Firefox 152 and Thunderbird 152, so users running those or newer releases are not affected. No other vendors or versions are reported as impacted.

The EPSS score is below 1%, showing a very low likelihood of exploitation at the time of the assessment, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is not explicitly documented; based on the description it is inferred that an attacker could trigger the issue by providing crafted input to the application, though the precise path is not detailed in the available references. The CVSS base score indicates that an exploit would result in system instability rather than full code execution.