This flaw stems from undefined behavior and an invalid pointer in the Canvas2D component of Gecko’s Graphics subsystem. If an attacker can trigger the problematic code path—most likely by serving malicious content that draws onto a canvas—the program can escape its sandbox, potentially executing arbitrary code with the privileges of the application. The vulnerability is a classic example of unsafe memory handling as identified by CWE‑693 and CWE‑824, and it directly threatens the confidentiality, integrity, and availability of the host system.

The issue affects Mozilla Firefox 143 and earlier, Firefox ESR 140.3 and earlier, Mozilla Thunderbird 143 and earlier, and Thunderbird ESR 140.3 and earlier. Hosted environments such as Red Hat Enterprise Linux 9 and 10 are also at risk if they run a vulnerable client version, because the escape occurs within the browser or mail client process.

With a CVSS score of 7.3 the vulnerability is classified as high severity. The EPSS score of less than 1 % indicates a low probability of being found or used in the wild at present. It is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via crafted web or email content that exercises Canvas2D; no local privilege escalation path is mentioned, so exploitation likely requires the victim to open a malicious page or message.