The Storage: Bucket File System component in Mozilla Firefox and Thunderbird can free memory while it is still in use, creating a use‑after‑free condition that results in memory corruption. This flaw permits an attacker to manipulate program state and potentially execute arbitrary code, although the remote‑code‑execution potential is inferred and not explicitly stated in the CVE description.

Mozilla Firefox versions prior to 158 in the standard release, Firefox ESR releases prior to 153.5 in extended support releases, Mozilla Thunderbird versions prior to 158 in the standard release, and Thunderbird ESR releases prior to 153.5 in extended support releases contain the vulnerable code; versions 158 and later, ESR 153.5 and later, as well as Thunderbird 158 and later, ESR 153.5 and later, include the mitigation fix and are not affected.

The CVSS score of 5.4 indicates medium severity, but use‑after‑free vulnerabilities can lead to remote code execution if an attacker can supply crafted input to the component – this possibility is inferred from the nature of the flaw. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, so the exact exploitation probability cannot be quantified, yet the lack of available public exploits does not reduce the potential impact and the safest assumption is that the vulnerability remains exploitable until patched.