The updated CVE description still identifies a use‑after‑free in the DOM animation component of Firefox, which can corrupt memory when the animation system accesses freed objects. The result could be arbitrary code execution or a browser crash. Although no public exploit is reported, the nature of a use‑after‑free flaw in a core browser feature typically permits remote attackers to trigger the vulnerability simply by loading crafted web content.

Affected versions are the standard Firefox release prior to 158 and the Firefox ESR builds older than 115.43 or 153.5, as well as Thunderbird versions prior to 158 and Thunderbird ESR builds older than 153.5. The fix was introduced in Firefox 158, ESR 115.43, and ESR 153.5, and in Thunderbird 158 and Thunderbird ESR 153.5, so any installation older than those releases remains vulnerable.

The CVSS score of 5.4 indicates a medium severity vulnerability. The EPSS score is 0.00228 (<1%), and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Nonetheless, a use‑after‑free in a core browser component can be triggered remotely via malicious web content, maintaining a significant risk even with the medium score.