The vulnerability is a use‑after‑free in the JavaScript: WebAssembly component of Mozilla Firefox. It allows an attacker to access or execute memory that has already been freed, potentially corrupting the browser’s internal state. This type of flaw could lead to untrusted code execution or a denial of service but no confirmed exploits exist.

Mozilla Firefox versions earlier than 158 are affected. Users running Firefox 157 or lower must upgrade, as the fix is incorporated in version 158 and later.

The CVSS score of 5.4 indicates a medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. No public exploits have been reported, and the attack vector most likely involves malicious WebAssembly modules served over the internet. While the potential for code execution exists, it has not been confirmed in the wild.