The vulnerability is a use‑after‑free flaw in the Audio/Video playback component, allowing an attacker to supply a crafted media file that could trigger memory corruption. This corruption may cause crashes or other undefined behavior, but a specific capability such as remote code execution or denial‑of‑service is not asserted in the official description.

Mozilla Firefox and Mozilla Thunderbird products running versions prior to Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird ESR 153.5 are affected, because the flaw was fixed in those releases.

The CVSS score of 5.4 indicates moderate severity based on the exploitation potential described. The EPSS score of <1% signals a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Use‑after‑free bugs are usually triggered remotely by input such as media files, though no concrete evidence of exploitation for this CVE is provided, so the risk is considered moderate with a low likelihood of real‑world attacks.