The vulnerability is a memory safety flaw that can provoke buffer overflow, out‑of‑bounds read, use‑after‑free, or arbitrary write conditions as indicated by CWEs 119, 125, 416, and 787. The defect exists in older builds of Firefox and Thunderbird before versions 152 (Firefox) and 140.12 (Thunderbird). Abuse of the bug could let an attacker execute arbitrary code within the vulnerable browser or mail client, potentially granting full control of the victim’s user session and the underlying operating system.

Mozilla releases such as Firefox and Thunderbird are affected when running any build earlier than Firefox 152, Firefox ESR 140.12, Thunderbird 152, or Thunderbird ESR 140.12. These versions lack the memory safety patch applied in the respective newer releases.

The CVSS score of 7.5 places this vulnerability in the high severity range. The EPSS score of < 1% indicates that currently few attacks are expected, and the vulnerability is not in the CISA KEV catalog. Exploitation would likely require maliciously crafted content—such as a crafted message, web page, or attachment—that triggers the buffer or pointer error within the browser or mail client. If successfully leveraged, the flaw could lead to full compromise of the application and potentially the underlying operating system. Therefore, the risk of exploitation remains high enough to warrant patching.