A use‑after‑free flaw exists in the SVG component, as identified in the recent description. The vulnerability arises from a freed memory reference that may be abused when the browser processes an SVG file. The description does not explicitly state the outcome, so it is unclear whether an attacker can execute code or simply cause a crash. The weakness is categorized as CWE‑416.

The flaw affects all Mozilla Firefox releases prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5, as well as all Thunderbird releases prior to Thunderbird 158 and 153.5. Any installation that can render SVG content from untrusted sources is vulnerable.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a client‑side SVG file loaded by a user or a malicious web page, making the threat opportunistic. Because the effect of the use‑after‑free is not explicitly documented, it is uncertain whether exploitation could result in code execution or only a crash, but the possibility remains.