An invalid pointer in the core and HTML components of the DOM can lead to memory corruption that may allow an attacker to execute arbitrary code on the affected system. The flaw is categorized as CWE‑824, which indicates an unrecovered invalid pointer usage that can be exploited for compromising application integrity.

Mozilla Firefox versions prior to 148 and Mozilla Thunderbird versions prior to 148 are affected. The vulnerability is present in all builds of both browsers that use the vulnerable DOM implementation, as reflected by the CPE entries for Firefox and Thunderbird.

The CVSS score of 9.8 reflects severe potential impact and the very low EPSS (<1%) suggests a modest likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. The likely attack vector is delivering malicious web content or HTML emails that trigger the invalid pointer usage, potentially enabling remote code execution or privilege escalation. Successful exploitation would compromise confidentiality, integrity, and availability of the victim’s data and system.