The vulnerability is a classic use‑after‑free in the graphics text rendering subsystem of Mozilla Firefox. A use‑after‑free can corrupt memory during text rendering, and while the CVE description does not explicitly state the available impact, such a flaw can potentially lead to crashes or, in severe cases, execution of arbitrary code within the browser process.

Mozilla Firefox browsers, including both stable and ESR branches, are affected. All versions prior to Firefox 154, ESR 115.39, ESR 140.14, or ESR 153.1 are vulnerable, as the fix was applied only in those releases and newer ones.

No EPSS score is available and the CVE is not listed in the CISA KEV catalog, so the exact probability of exploitation is unclear. A use‑after‑free flaw in a graphics component can usually be triggered by rendering malicious content from a webpage, which is inferred from the component’s role; however, exploitation would require the browser to process the offending content. The potential impact is high if the flaw is successfully leveraged.