A use‑after‑free flaw exists in the JavaScript engine’s JIT component. The flaw allows a malicious actor to access memory that has already been freed, potentially enabling arbitrary code execution. The weakness is a classic memory corruption vulnerability.

Mozilla Firefox browsers, including the standard distribution and the Extended Support Release variants, are affected. Any release older than Firefox 158, ESR 115.43, or ESR 153.5 is vulnerable. Mozilla Thunderbird browsers down to Thunderbird 158 and 153.5 are also affected.

The CVSS score of 5.4 indicates a medium severity level. The EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, meaning no confirmed widespread public exploitation has been reported yet. Based on the vulnerability description, it is inferred that a malicious script could trigger the use‑after‑free, potentially leading to remote code execution when executed in the victim’s browser context. No publicly documented exploit exists at this time.