This vulnerability is a sandbox escape caused by a use‑after‑free error in the graphics component, which permits an attacker to break out of the browser sandbox and execute arbitrary code on the host system. The description does not enumerate trigger conditions, but it is inferred that specially crafted media or web content may trigger the use‑after‑free, potentially compromising the integrity and confidentiality of the machine.

Mozilla Firefox and Thunderbird are affected. The remedial releases that contain the fix are Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. Users running an earlier version of any of these products remain vulnerable.

With a CVSS score of 9.6, this flaw provides high‑impact remote code execution capabilities. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the bug could be exploited remotely via crafted web content, but there is no evidence of active exploitation in the wild, so the likelihood remains low‑to‑moderate under normal conditions.