The vulnerability is a race condition in the Graphics: Text component that can trigger a use‑after‑free. When a concurrent operation corrupts the pointer after memory release, the browser may access invalid data. This can lead to memory corruption that might crash the browser application. The CVSS score of 4.2 indicates a low severity and suggests that the flaw is unlikely to provide a straightforward remote code execution path.

Mozilla Firefox is affected. All installations of Firefox older than version 158 and all ESR builds older than version 153.5 contain the vulnerability. The vendor fixed the issue in Firefox 158 and ESR 153.5.

The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, implying no widespread exploit has been reported. The low CVSS rating limits the potential impact. Although a local attacker or one able to supply crafted graphical content could potentially trigger the use‑after‑free, the data does not confirm that a remote or web‑based exploitation path exists. No evidence shows remote code execution capability from a standard web page.