The flaw occurs in the Streams component of the DOM when a reference to an object is used after the object has been freed. This can lead to memory corruption that an attacker could exploit to execute arbitrary code or cause a denial of service. The vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. The weakness is a classic use‑after‑free error, making the victim's process an execution target whenever the vulnerable component processes malicious content.

The vulnerability affects Mozilla Firefox browsers and Thunderbird. Versions before Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5 are vulnerable. The issue applies to all platforms where the applications run.

The EPSS score is unavailable and the vulnerability is not present in the CISA KEV catalog, so the current exploitation probability is unknown. The CVSS score of 5.4 indicates moderate severity. Because the flaw is a use‑after‑free in the core DOM, attackers can likely trigger it by loading malicious web pages or scripts. The lack of a publicly known exploit makes the risk uncertain but the inherent severity of the flaw suggests a moderate to high potential impact if an exploit exists.