The reported flaw is a use-after-free bug in the Audio/Video component of Firefox. This defect occurs when the browser frees memory that is still referenced by code handling media processing, allowing an attacker to read or modify memory contents. When exploited, the vulnerability can lead to arbitrary code execution or data disclosure, compromising the confidentiality, integrity, or availability of the affected system.

Vulnerable versions include Mozilla Firefox prior to version 158, as well as the ESR branches before 115.43 and 153.5. Users running these releases on any platform are at risk until they apply the available fixes.

The CVSS and EPSS scores are currently unavailable, and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector involves delivery of a crafted audio or video file that triggers the fault; this would typically require a user to open or view the file in an affected browser. Since the exploit would need a locally valid exploit, the risk remains high for systems with vulnerable software, especially if users routinely process media from untrusted sources.