The vulnerability is a use‑after‑free in the XML component that occurs when a memory block is freed and subsequently accessed again. This flaw can result in undefined behavior that, under typical use‑after‑free conditions, allows an attacker to execute arbitrary code or crash the affected application. The impact is limited to the process in which the content is parsed, but code inserted through the flaw could run with the application's privileges, potentially affecting the confidentiality and integrity of the user’s data and the availability of the application.

Mozilla Firefox browsers before version 158, Firefox ESR releases prior to 115.43 and 153.5, and Mozilla Thunderbird before version 158 or its ESR releases before 153.5 are affected. Users running any of these versions should verify their current installation and update to the latest patched release.

The CVSS score of 5.4 indicates a moderate severity vulnerability, and the EPSS score of less than 1% suggests a very low exploitation probability at present. The flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves delivery of crafted XML content that is parsed by the affected browser or email client, either locally through user‑opened files or remotely via web content or email attachments. The flaw does not require elevated privileges, making it accessible to any user of the application.