A use‑after‑free flaw exists in the DOM Core and HTML components, allowing an attacker to reference freed memory during page rendering. If successfully exploited, this could result in arbitrary code execution or denial of service by corrupting program state. The vulnerability was fixed in Firefox ESR 140.17, Firefox ESR 153.4, Firefox 157, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. The weakness is represented by CWE‑416.

Mozilla Firefox and Thunderbird are affected. The flaw was remediated in Firefox ESR 140.17, Firefox ESR 153.4, and Firefox 157; Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. Any earlier releases remain vulnerable.

The CVSS score of 8.8 indicates high severity. The EPSS score is < 1%, and the issue is not listed in CISA KEV, indicating no current known exploitation reports. However, use‑after‑free vulnerabilities can be highly consequential, and the lack of a public exploitation status does not diminish the risk. Since the flaw is not publicly disclosed with exploit code, the likelihood of exploitation is uncertain but potentially high if attackers target high‑value users.