The vulnerability lies in the File Handling component of Mozilla products and is classified as CWE-66 (Configuration and Deployment Management) and CWE-693 (Protection Mechanism Failure). It enables malicious actors to bypass implemented mitigations that enforce safe file handling, potentially altering program behaviour. The impact constitutes a mitigation bypass that may facilitate exploitation of other weaknesses.

Both Mozilla Firefox and Mozilla Thunderbird are affected. In Firefox, all versions before 150 and ESR releases prior to 140.10 contain the flaw; Thunderbird is vulnerable in all versions before 150 and ESR releases before 140.10. The issue applies to every build of these products that does not include the state‑of‑the‑art mitigation fix.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The risk depends on an adversary’s ability to supply files or code that reach the vulnerable component. While direct exploitation may require local or trusted code execution, a bypass of file‑handling mitigations could lower the bar for other attacks that rely on the same component. The vulnerability was officially fixed in Firefox 150 / ESR 140.10 and Thunderbird 150 / ESR 140.10.