Incorrect boundary conditions in the Networking: JAR component allow an attacker to manipulate the parsing of JAR files, causing a buffer overflow that can lead to arbitrary code execution. The vulnerability stems from a lack of proper bounds checking (CWE-119). If exploited, the attacker could gain full control over the affected process, compromising confidentiality, integrity, and availability of the system.

Mozilla distributes the affected code in both Firefox and Thunderbird. The bug was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Therefore, any installations of Firefox or Thunderbird older than those releases are vulnerable. This includes all current standard releases and any ESR branches released prior to those numbers.

The CVSS score of 9.8 classifies the issue as critical, and the EPSS score is reported as <1%, indicating that publicly known exploitation attempts are currently rare, but the high severity warrants prompt action. The vulnerability does not appear in the CISA KEV catalog, but the lack of known exploits does not mitigate the risk of future attacks. The likely attack path involves supplying a crafted JAR file to a user, who then opens it, triggering the overflow. Therefore, the risk escalates in environments where JAR files are downloaded and processed without additional validation.