A use‑after‑free flaw exists in the SVG rendering component of Mozilla Firefox and Mozilla Thunderbird. The vulnerability arises from improper handling of memory during SVG processing, which may allow an attacker to execute arbitrary code on the system that renders the affected SVG file. This flaw can compromise confidentiality, integrity, and availability.

This vulnerability affects all versions of Mozilla Firefox and Mozilla Thunderbird released prior to version 159. Versions 159 and later incorporate the upstream fix and are no longer affected.

The use‑after‑free weakness is a high‑severity flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likelihood of exploitation would require the user or an attacker to render a malicious SVG file in the browser or email client. This inference is based on the nature of the bug and the fact that the flaw is tied to SVG processing. The risk of exploitation remains significant for environments that allow arbitrary SVG content to be rendered.