The vulnerability is an integer overflow detected in the core SVG rendering engine. It can allow an attacker who controls SVG input to manipulate size calculations, potentially leading to memory corruption and remote code execution when an SVG file is rendered. The weakness is classified as CWE-190, which typically results in loss of confidentiality, integrity, or availability if exploited.

The flaw affects Mozilla Firefox versions before 143, including the ESR lines before 115.28 and 140.3, as well as Mozilla Thunderbird before 143 and before the ESR 140.3 release. Attackers could target any user who opens a malicious SVG file in these browsers.

The CVSS score of 8.8 indicates a high severity, but the EPSS score of less than 1% and the absence from the KEV catalog suggest that exploitation is currently unlikely. Nonetheless, the attack vector is likely remote via crafted SVG, so the risk to end users remains significant if no patch is applied.