Use‑after‑free in the WebRTC Signaling component can potentially lead to remote code execution. The flaw arises when the component incorrectly handles reference counting, resulting in an invalid memory access. Vulnerability is classified under CWE‑416 and has a CVSS score of 9.8, indicating a high‑severity risk. Based on the description, it is inferred that an exploitation could compromise confidentiality, integrity, and availability of the user’s system.

Affected products are Mozilla Firefox and Mozilla Thunderbird, both in their standard releases and ESR branches. The vulnerability was fixed in Firefox 146 and Firefox ESR 140.6, as well as in Thunderbird 146 and Thunderbird ESR 140.6. Users running earlier versions are at risk until they upgrade.

The CVSS score of 9.8 signals a critical threat, but the EPSS score of less than 1% shows that exploitation is currently unlikely. The vulnerability is not listed in CISA KEV, meaning no known active exploits have been catalogued. Based on the description, it is inferred that an attacker could potentially launch an exploit via malicious WebRTC signaling traffic, so the risk remains high for systems that allow untrusted network content.