The vulnerability arises from a use-after-free bug in the Audio/Video component of Firefox. The flaw permits an attacker to accidentally reference freed memory during media playback, which can lead to arbitrary code execution, denial of service, or other unintended behavior. The weakness is a classic use‑after‑free scenario (CWE‑416) that can compromise confidentiality, integrity, and availability if successfully exploited. While the vendor discloses no specific preconditions, the flaw directly impacts the audio/video pipeline used for rendering external media streams.

Mozilla Firefox, including the standard release line and both Firefox ESR 115.44 and ESR 153.6. Versions earlier than 159 in the main line, and earlier than 115.44 or 153.6 in the ESR tracks, are vulnerable. Users running any of these affected releases should consider upgrading promptly. The vulnerability is limited to Firefox installations that process media content; it does not affect other Mozilla applications.

An attacker could trigger the flaw by delivering crafted media files or manipulating playback parameters, potentially from a remote or local source. The CVSS score is not publicly available, but use‑after‑free bugs are typically rated high severity, with many exhibiting execution of arbitrary code. The EPSS score is not provided, and the vulnerability is not yet in CISA KEV. Nonetheless, because the flaw can allow remote code execution without authentication, it presents a significant risk, especially on systems exposed to untrusted media inputs. The likely attack vector is through malicious media content viewed by the browser.