This vulnerability stems from a use‑after‑free error inside the XSLT processing component of Mozilla Firefox and Thunderbird. The bug can potentially allow an attacker to trigger a memory corruption condition that may lead to arbitrary code execution. The absence of additional detail in the provided description leaves the exact impact in the hands of implementation specifics, but the nature of the flaw indicates a high‑severity consequence.

Mozilla Firefox and Thunderbird are affected. The issue was addressed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, and in Thunderbird versions 157, 153.4 and 140.17. All earlier releases lacking these patches are potentially vulnerable.

The CVSS score is 8.8, indicating high severity. The EPSS score of 0.00311 means the likelihood of exploitation in the wild is very low but not not listed in the CISA KEV catalog. The unchecked use‑after‑free could be triggered by processing malicious or otherwise crafted XSLT content, which may be delivered through web pages, extensions, or other XML handling mechanisms. Attackers with the capability to cause Firefox or Thunderbird to process untrusted XSLT would be able to exploit this flaw.