A use‑after‑free bug exists in the WebAssembly component of the JavaScript engine. When malicious WebAssembly code is processed, the bug can corrupt heap memory, potentially overwriting control data or other critical structures. This leads to arbitrary memory corruption that an attacker may exploit for remote or local code execution, or to cause a denial of service.

Firefox and Thunderbird, both the mainline and Extended Support Release branches, are affected. The flaw is fixed in Firefox ESR 140.17, ESR 153.4, and Firefox 157; and in Thunderbird 140.17, 153.4, and 157. All releases older than those versions remain vulnerable.

The CVSS score of 8.8 indicates high severity. An EPSS score of <1% shows a very low estimated exploitation probability, yet the nature of the memory corruption and the ability to inject WebAssembly code mean a sizeable risk if exploited. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a malicious WebAssembly module delivered through a web page or email, which does not require privileged access to execute