This vulnerability involves the interruption of RegExp bailout processing in Mozilla Firefox, allowing additional JavaScript execution that can trigger garbage collection at an unexpected time. This behavior could lead to instability or crashes. The issue was resolved in Firefox 136 and Firefox ESR 128.8, as well as corresponding Thunderbird versions. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or integrity impact, but high availability impact.

The vulnerability can cause unexpected garbage collection during RegExp bailout processing, potentially leading to denial of service or application instability. There is no indication of confidentiality or integrity compromise. No known exploits have been reported in the wild. The impact is primarily on availability, as reflected in the CVSS vector.

An official fix is available and has been released in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8. Users and administrators should update to these or later versions to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.