The flaw is an integer overflow in the JavaScript Standard Library component of Mozilla Firefox and Thunderbird. The overflow could cause memory corruption or instability. Based on the description, it is inferred that this could enable arbitrary code execution in the worst case. The high CVSS score of 9.8 indicates that a successful exploitation would have severe consequences, although the official advisory does not explicitly confirm code execution as a documented outcome.

The vulnerability affects all releases of Mozilla Firefox and Mozilla Thunderbird before version 148 and Firefox ESR 140.8 or Thunderbird ESR 140.8. All builds released after those versions contain the fix and are not affected.

The exploitation probability remains very low, with an EPSS score below 1 % and no listing in the current CISA Known Exploited Vulnerabilities catalog. Attackers would need to induce the affected engine to execute malicious JavaScript—such as hosting a malicious web page in Firefox or delivering a corrupt email to Thunderbird. While the mechanism could be leveraged for code execution, this has not been publicly demonstrated, so the threat remains inferred rather than confirmed.