The vulnerability appears as a use-after-free bug in the Audio/Video component used by Mozilla Firefox and Thunderbird. When the media processing code frees memory that is still referenced, an attacker can exploit the flaw to read or overwrite memory. This could potentially lead to code execution or data disclosure, compromising the confidentiality, integrity, or availability of the affected system.

Vulnerable versions include Mozilla Firefox prior to version 158, Mozilla Thunderbird prior to version 158, and the ESR branches before 115.43 and 153.5 for both Firefox and Thunderbird. Users running these releases on any platform are at risk until they apply the available fixes.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves delivery of a crafted audio or video file that triggers the fault; this would typically require a user to open or view the file in an affected browser or email client. Since the exploit would need a locally valid attack, the overall risk remains moderate for systems with vulnerable software, especially if users routinely process media from untrusted sources.