The vulnerability is a use-after-free in the Graphics: Canvas2D component that allows an attacker to gain elevated system privileges from within the Firefox browser, potentially leading to arbitrary code execution and data tampering.

Mozilla Firefox versions up to 158, and older ESR releases before 115.44 or 153.6, are impacted. The problem specifically resides in the Canvas2D code path of Firefox’s graphics engine.

The CVSS score is not publicly listed and no EPSS data exists. However, because the flaw allows privileged elevation, it is treated as a high-severity issue. No public exploits or KEV listing are reported, but local attackers can exploit the browser to gain broader system access if they manage to trigger the use‑after‑free. Organizations should treat it as a critical local threat.