The flaw is a use‑after‑free bug in the Audio/Video playback engine. When a browser consumes a malicious media file, the component may dereference a pointer that has already been freed. This can lead to arbitrary code execution in the context of the browser process, allowing an attacker to gain full control over the client machine. The weakness aligns with CWE‑416, a classic use‑after‑free vulnerability.

Mozilla Firefox is affected. Any installation of Firefox that predates version 159, or the Firefox Extended Support Release builds 115.44 and 153.6, is potentially vulnerable. Versions released after these fixes are considered safe. The issue does not affect other Mozilla products or external browsers.

The CVSS score is not supplied, and EPSS data is unavailable, but the nature of the bug suggests a high chance of exploitation once a user processes a crafted media file. Although there is no current listing in the CISA KEV catalog, the possibility of a remote code execution vector means the vulnerability should be treated with urgency. Attackers most likely would deliver a malicious audio or video file to the target, possibly via an infected website, email attachment, or social engineering, and trigger the flaw when the user opens or plays the content.