The vulnerability allows an attacker to cause a denial of service by exploiting a flaw in the XML component of the software. The flaw was addressed in later releases, so the primary impact is service interruption that can affect users who rely on the affected application for everyday tasks. This issue is categorized as a resource exhaustion weakness and a privilege escalation limit violation, which are reflected by the assigned CWE identifiers.

Mozilla Firefox and Mozilla Thunderbird are affected. Users running any unsupported version prior to 149 are at risk. The exact range of vulnerable versions is not listed, but the advisory indicates that Firefox 149 and Thunderbird 149 contain the fix. Any installation of a product version earlier than these releases should be considered vulnerable.

The reported CVSS score of 7.5 indicates a high severity of this denial‑of‑service condition. The EPSS score is below 1%, indicating that exploitation is unlikely to be widespread, and the vulnerability is not flagged in the CISA KEV catalog. The most probable attack vector is local, as the description does not detail a network trigger, so an attacker would need access to the user’s system or a way to supply crafted XML to the component.