A use‑after‑free defect exists in Mozilla’s JavaScript engine when executing WebAssembly modules. This weakness allows memory to be corrupted after an object has been freed, possibly enabling an attacker to influence program execution or corrupt data. The official description does not state the precise impact, so it is inferred that such corruption could lead to data integrity issues or compromise control flow, thereby creating a risk of arbitrary code execution.

All standard releases of Mozilla Firefox and Thunderbird, as well as ESR branches before Firefox 148, ESR 140.8, Thunderbird 148, and ESR 140.8, are affected. Any version that does not include the patch for this use‑after‑free is vulnerable.

The CVSS score of 8.8 classifies the flaw as high severity. Its EPSS score is reported as less than 1 %, indicating a very low current probability of exploitation, and it is not included in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the defect by delivering a malicious WebAssembly module through a web page or an email attachment, giving remote code execution potential in a scriptable context. Consequently, organizations should treat this vulnerability as high‑risk and apply the vendor patch promptly.