Use‑after‑free in the JavaScript garbage‑collector component. This flaw allows an attacker to manipulate memory that should no longer be referenced, potentially leading to the execution of arbitrary code within the browser or mail client process. The official fix was released in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

This vulnerability affects Mozilla Firefox and Mozilla Thunderbird. The flaw exists in versions prior to Firefox 159 and ESR 153.6, and in Thunderbird prior to version 159 and ESR 153.6. Users running older editions that have not been patched are vulnerable.

The CVSS score is not provided in the public data for this CVE. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the nature of the defect, a malicious web page or a JavaScript payload could trigger the use‑after‑free, potentially allowing remote code execution. The lack of an EPSS score means that the current exploitation probability cannot be quantified, but the vulnerability was publicly disclosed and fixed, suggesting it was considered exploitable.