A use‑after‑free flaw exists in the Layout: Text and Fonts component. When triggered, the browser or email client may free an object before all references to it are released. This can allow an attacker to corrupt memory, leading to crashes or the execution of injected code, thereby compromising the confidentiality, integrity, or availability of the affected system.

The vulnerability affects Mozilla Firefox and its ESR releases, as well as Mozilla Thunderbird. All versions prior to Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149, and Thunderbird 140.9 are susceptible.

With a CVSS score of 9.8 the flaw is considered critical, yet the EPSS score is below 1% and it is not listed in the CISA KEV catalog, indicating a low likelihood of exploitation at this time. The most plausible attack vector would be a crafted web page or email that triggers the text and font rendering engine, which would require the victim to view or open the malicious content. No public exploits are currently documented, but the high severity warrants immediate action.