This vulnerability is a use‑after‑free flaw in Firefox’s JavaScript WebAssembly engine. When a freed object is accessed, the engine may read or write arbitrary memory, which is a classic example of memory corruption under CWE‑416. Based on the updated description, it is inferred that if an attacker can trigger the flaw, they might manipulate memory that could eventually allow code execution, and that the flaw could be triggered by a malicious web page or compromised site hosting vulnerable WebAssembly code.

The issue affects all Mozilla Firefox releases older than the patches delivered in Firefox ESR 140.17, Firefox ESR 153.4, and Firefox 157, and it also affects all Mozilla Thunderbird releases older than the patches delivered in Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. Every active mainline build and any older Extended Support Release series that has not applied these updates remains vulnerable.

A CVSS score of 8.8 indicates a high impact vulnerability, while the EPSS score of < 1% indicates very low exploit probability. The vulnerability is not listed in CISA KEV, so no widespread exploitation has been reported. Based on the updated description, a remote attacker might trigger the flaw through a malicious web page or compromised site hosting vulnerable WebAssembly code, but specific exploitation details are not documented. Until affected users upgrade, the flaw remains possibly exploitable through in‑browser payloads.