Use‑after‑free in the Audio/Video component of Mozilla Firefox and Thunderbird can corrupt memory, potentially allowing an attacker to execute arbitrary code within the user’s process. The flaw results from improper memory handling and is classified as CWE‑416 and CWE‑825. Successful exploitation would compromise the confidentiality, integrity and availability of the affected system.

Mozilla Firefox versions prior to 145, the ESR releases 140.5 and 115.30, and Mozilla Thunderbird versions older than 145 or 140.5 are vulnerable. All affected editions run on the default audio‑video pipeline and are listed in the known CPE entries.

The CVSS score of 8.8 indicates high severity. EPSS below 1% suggests a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would likely require the attacker to supply a crafted audio or video file and require the user to view or open it, possibly through a web page or an email attachment. In such an event, the attacker could hijack the victim’s process and execute arbitrary code with the user’s privileges.