The CVE identifies a use‑after‑free condition in the Graphics: Text component of Mozilla's rendering engine. Based on the fact that a use‑after‑free can lead to memory corruption, it is inferred that an attacker could potentially read or write memory that has already been freed, which could corrupt the application's internal state or cause a crash.

Mozilla Firefox versions prior to 158, any Firefox ESR release earlier than 115.43 or 153.5, and Mozilla Thunderbird versions prior to 158 or any ESR release before 153.5 are vulnerable. The patches are integrated starting with Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

With a CVSS score of 5.4, the vulnerability is rated moderate. The EPSS score of less than 1% suggests a low probability of exploitation in the near term. The flaw is not listed in the CISA KEV catalog, indicating no widespread exploitation is known. The likely attack vector would involve rendering specially crafted text or graphics that trigger the vulnerable rendering path, typically from untrusted web content or email attachments.