Use‑after‑free was discovered in the JavaScript: WebAssembly component of Firefox and Thunderbird. The flaw allows a freed object to be accessed after it has been released, enabling an attacker to read or write arbitrary memory. This can lead to browser crashes or provide a foothold for further exploitation of the browser process.

Versions of Mozilla Firefox and Thunderbird released before v158 are affected. Users operating those earlier editions are vulnerable until the update is applied.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of active exploitation. Attackers would need the ability to execute JavaScript or load WebAssembly modules in a vulnerable browser instance, making the exploitation vector local to the user’s browsing activity.