The vulnerability is a use‑after‑free flaw in the JavaScript engine. When triggered it can corrupt memory, which may allow an attacker to overwrite executable code and execute arbitrary instructions. The flaw carries the potential to compromise confidentiality, integrity, and availability of the affected system by enabling remote code execution.

Mozilla Firefox versions prior to 148 and ESR 140.8, Mozilla Thunderbird versions prior to 148 and ESR 140.8 are affected. All other Mozilla browsers and mail clients released after these versions are not impacted.

The CVSS score of 9.8 denotes critical severity. The EPSS score of <1% suggests exploitation is unlikely at the moment, but the vulnerability remains high risk. It is not listed in the CISA KEV catalog. An attacker would need to lure a user into visiting a malicious web page or opening a crafted email that triggers the JavaScript engine. Based solely on the description, the attack requires user interaction and exploitation of the memory corruption trigger.