A use‑after‑free flaw was found in the Networking: HTTP component of Mozilla Firefox and Thunderbird. The vulnerability allows an attacker to access de‑allocated memory, potentially enabling arbitrary code execution. The weakness originates from improper memory management and presents significant risks to confidentiality, integrity, and availability for systems that run vulnerable browser versions.

Mozilla Firefox and Thunderbird versions that do not include the security fix are affected. Specifically, any release prior to Firefox 159, Firefox ESR 115.44, or Firefox ESR 153.6, as well as Thunderbird versions prior to 159 or 153.6, remains vulnerable. Users of these older builds must update to a protected version.

The CVSS score and EPSS metric are not publicly available, and the vulnerability is not currently listed in the CISA KEV catalog. Because the flaw is a classic use‑after‑free that can lead to arbitrary code execution, it is inferred to allow remote exploitation over a network connection to the browser. The lack of publicly available exploit probability data suggests that while the vulnerability is serious, the exploitation prevalence is currently unknown.