The vulnerability is a use‑after‑free bug located in the Networking: Cache component of Mozilla Firefox and Mozilla Thunderbird. An attacker could potentially cause the browser to read or write memory after the associated object has already been freed, leading to memory corruption. Depending on the context, this flaw could be leveraged to execute arbitrary code or otherwise compromise the integrity and confidentiality of the victim system.

This issue affects all Mozilla Firefox releases prior to the following security releases: Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. It also affects all Mozilla Thunderbird releases prior to Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. Users running earlier versions on any supported operating system are potentially vulnerable.

The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Use‑after‑free flaws are known to have a high exploitation likelihood when a suitable trigger can be induced. In the absence of a published exploit, the risk is considered significant because the flaw resides in a core networking component and could allow remote attackers to exploit the bug by serving malicious content. The CVSS score of 8.8 indicates a high severity level, confirming the potential impact described in the vulnerability.