According to updated information, this CVE identifies a memory safety bug that can cause memory corruption. The vulnerability is flagged under several CWEs – including CWE‑119, CWE‑125, CWE‑416, CWE‑787, and CWE‑825 – which indicate out‑of‑bounds reads/writes, buffer overflows, and use‑after‑free conditions. It has been fixed by updating Firefox to 152 or the ESR 140.12 branch and Thunderbird to 152 or the ESR 140.12 branch.

The security flaw affects Mozilla Firefox versions 152 and the ESR 140.12 branch, as well as Mozilla Thunderbird versions 152 and the ESR 140.12 branch. No other product versions are listed as vulnerable.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score of less than 1 percent suggests that, as of the time of assessment, the likelihood of exploitation is very low. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The attack vector is not explicitly detailed in the advisory; however, based on the nature of the bug, it is inferred that the vulnerability could be triggered by malformed data received during normal operation, potentially allowing remote exploitation in environments where the affected applications process untrusted input.