The vulnerability is a use‑after‑free flaw in the Graphics: Text component of Firefox and Thunderbird. When the software processes certain text elements it frees memory that is still in use, which can corrupt or leak data. Although the advisory does not explicitly state the exact damage, a use‑after‑free of this nature can enable an attacker to read or modify arbitrary memory and potentially execute code if corrupted memory is later used in control flow.

Mozilla Firefox and Mozilla Thunderbird versions earlier than 159 include the unpatched Graphics: Text component. Users running any of these releases are exposed to the flaw unless they upgrade the software.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so there is no published measure of exploitation frequency. The lack of a CVSS score makes formal severity uncertain, but use‑after‑free defects that enable memory corruption are generally considered high or critical. The likely attack vector is the delivery of malicious content to the browser – for example, through a compromised website or a phishing page – which would trigger the vulnerable path.