This vulnerability is a use‑after‑free condition located in the Audio/Video: GMP component. It allows memory corruption that could enable an attacker to replace privileged data structures, leading to arbitrary code execution or other destructive actions. The weakness is identified as CWE‑416, indicating improper handling of freed memory after an object's lifespan has ended.

The affected products are Mozilla Firefox and Mozilla Thunderbird. Versions prior to 146 of each contain the flaw; versions 146 and newer have the fix applied.

The software risk rating is high with a CVSS score of 9.8. The EPSS indicates a <1% probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the flaw can be triggered by processing a malicious media file, suggesting a remote attack vector from the network or local via compromised media files. The lack of explicit exploitation details leaves some uncertainty about the exact conditions necessary to exploit it, but the combination of high severity and low exploitation probability indicates that urgent mitigation is recommended.