Use‑after‑free vulnerability exists in Firefox’s Crash Reporting component. The flaw allows a reference to a deallocated object to be accessed, which can corrupt memory. The impact of such corruption is potentially severe, including application crashes, denial of service, or in some cases arbitrary code execution, depending on how the attacker exploits the memory state. The CVE entry notes the vulnerability but does not confirm a specific exploitation path.

All Mozilla Firefox releases prior to version 158, as well as Firefox ESR versions older than 153.5, are vulnerable. The issue was addressed in Firefox 158 and the ESR 153.5 release. Users running earlier builds of Firefox or ESR are potentially exposed.

No CVSS or EPSS score is currently published for this vulnerability, and it is not listed in the CISA KEV catalog. The lack of quantification makes precise risk assessment difficult, but the bug is in a widely deployed component and a use‑after‑free flaw can provide a vector for remote code execution or denial of service. The likely attack vector is a malicious web page or local content that triggers crash reporting, leading to the use‑after‑free condition, though detailed public exploitation evidence is not available.