The vulnerability is a use‑after‑free in the JavaScript WebAssembly component of Mozilla browsers. Based on the description, it is inferred that an attacker could trigger it by delivering a crafted WebAssembly module that causes the engine to access memory after it has been freed, leading to potential corruption of internal state. The defect was fixed in Firefox 158 and Thunderbird 158, and no confirmed exploits have been reported. Though the flaw could theoretically enable memory corruption or code execution, such attacks have not yet been documented.

Mozilla Firefox and Thunderbird versions earlier than 158 are affected. Users running Firefox or Thunderbird 157 or lower must upgrade, as the fix is incorporated in version 158 and later.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. No public exploits have been reported, and the attack vector is inferred to involve malicious WebAssembly modules served over the internet. While the potential for code execution exists, it has not been confirmed in the wild.