The vulnerability is a use‑after‑free condition within Firefox’s SVG processing engine. When a malicious or malformed SVG document is rendered, the browser may access memory that has already been released, leading to unintended behavior such as a crash or other memory corruption. While the description does not confirm arbitrary code execution, a typical use‑after‑free can potentially allow that if the attacker can exploit the corrupted memory state.

Mozilla Firefox versions up to 158 and earlier Extended Support Release versions before 153.6 are affected. The issue is fixed in Firefox 159 and ESR 153.6; any later versions contain the necessary fix.

No CVSS score is publicly available, and the EPSS score is not reported. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of a crafted SVG file that the browser will render, such as by opening a local file or loading a malicious web page. The exploit would require the victim’s browser to process the SVG; however, no detailed exploitation steps are provided in the advisory, so the exact likelihood of successful exploitation remains uncertain.