This vulnerability is a use‑after‑free bug in the Audio/Video playback component. If triggered, it can allow an attacker to execute code of their choosing, potentially leading to full compromise of the affected system. The weakness permits the exploitation of memory management errors that may result in arbitrary code execution, data corruption, or denial of service.

Mozilla Firefox is affected. All releases prior to Firefox 159, including all older builds of Firefox ESR before 115.44 and before 153.6, are vulnerable. Affected builds include the standard Firefox releases older than 159 and the ESR streams that have not applied the patch in versions 115.44 and 153.6.

The Common Vulnerability Scoring System score is not disclosed, but use‑after‑free bugs typically score highly due to their potential for arbitrary code execution. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a malicious media file or stream processed by the playback component. The exploit requires the target to process such content, which can occur through user‑initiated or remote media access. Due to the severity of potential exploitation, the risk is considered significant.