This vulnerability stems from an undefined behavior in the DOM core and HTML handling components. The flaw can produce unpredictable program state or corrupt memory, which may lead to loss of integrity or other security issues. The CVE description does not explicitly state that arbitrary code execution is possible, so any claims beyond memory corruption are inferred from common exploit patterns for such faults.

All versions of Mozilla Firefox and Thunderbird released before Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8 are affected. The security fixes are included in those newer releases, so upgrading to those versions or later removes the vulnerability.

The vulnerability receives a very high CVSS score of 9.8, indicating a severe potential impact. The EPSS score is below 1 %, suggesting a low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog, so no publicly known exploit has been reported. Based on the type of flaw and typical exploitation methods for DOM memory corruption, the likely attack vector is remote, involving a user opening malicious web content or an email attachment that triggers the bug.