The Storage: Bucket File System component in Firefox can free memory while it is still in use, creating a use‑after‑free condition that results in memory corruption. This flaw permits an attacker to manipulate program state and potentially execute arbitrary code. The weakness is identified as CWE‑416.

Mozilla Firefox versions prior to 158 in the standard release, and releases prior to 153.5 in Firefox ESR, contain the vulnerable code. Versions 158 and later, as well as ESR 153.5 and later, include the mitigate fix and are not affected.

The CVSS score of 5.4 indicates medium severity, but use‑after‑free vulnerabilities can lead to remote code execution if an attacker can supply crafted input to the component. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, so the exact exploitation probability cannot be quantified; however, the lack of available public exploits does not reduce the potential impact and the safest assumption is that the flaw remains exploitable until patched.