A use‑after‑free flaw exists in Mozilla Firefox’s SVG component. The vulnerability allows an attacker to exploit a freed memory reference and execute arbitrary code, or cause a crash, through a specially crafted SVG file. The weakness corresponds to CWE-416 and enables an attacker to compromise confidentiality, integrity, and availability of the target system.

The flaw affects all Mozilla Firefox releases prior to Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. Any installation of these older browsers that can render SVG content from untrusted sources is vulnerable.

The CVSS score is unspecified, but the flaw enables remote code execution and therefore carries high severity. The EPSS score is unavailable, so the current exploit probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely a client‑side SVG file loaded by a user or a malicious web page, making the threat opportunistic but potentially devastating where the browser is exposed to untrusted content.