A use‑after‑free flaw exists in the Canvas2D component within the graphics subsystem. When JavaScript code performs operations on a canvas element, it can trigger access to a freed internal structure, leading to memory corruption. This corruption can cause the process to crash or, if an attacker can influence the corrupted data, could allow them to alter program flow and execute arbitrary code. The vulnerability is classified as CWE-416.

The flaw affects multiple Firefox releases and Thunderbird builds. Patched ESR builds include Firefox ESR 115.42, ESR 140.17, ESR 153.4, and the regular release is patched in Firefox 157. Thunderbird is fixed in Thunderbird 157, 140.17, and 153.4. Earlier releases before these patched versions may still be vulnerable. All these builds support rendering of JavaScript canvas elements until the patch is applied.

The CVSS score is 8.8, indicating a high severity vulnerability. The EPSS score is < 1%, signifying that exploitation is considered very unlikely but still possible. The flaw is not listed in the CISA KEV catalog. The Canvas2D API can be invoked by any web page, so the likely attack vector is remote via malicious site content, giving an attacker the possibility to trigger the use‑after‑free on a victim’s machine. While memory corruption is the immediate impact, an attacker may also attempt to manipulate the corrupted state to redirect execution and potentially run arbitrary code, though this has not yet been demonstrated. The overall risk is high for environments that allow untrusted web content.