The vulnerability stems from a miscompilation in the Just‑In‑Time compiler of the JavaScript engine, which permits a user to read memory content that should not be accessible. This leads to local information disclosure and is classified as CWE-200 and CWE-843, reflecting improper information exposure and the use of data for unintended purposes.

The issue affects Mozilla Firefox and Thunderbird, including their ESR branches, on all versions released before Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users on these earlier builds are susceptible to the disclosed flaw.

The vulnerability carries a CVSS score of 6.5 and an EPSS score of less than 1 percent, indicating a moderate severity but low probability of exploitation at this time. It does not appear in the CISA KEV catalog. The likely attack vector involves malicious JavaScript executed in a web page or email, enabling a local or remote attacker to trigger the JIT miscompilation. Based on the description, the attack requires the victim to render malicious content, though further details are not explicitly provided.