A compromised web process was able to trigger out‑of‑bounds reads and writes inside a more privileged process through carefully crafted WebGL textures. The flaw falls under two classic memory corruption weaknesses: reading beyond buffer bounds and writing beyond buffer limits. If successfully exploited, an attacker could corrupt memory in the privileged process, potentially leading to arbitrary code execution and compromising the confidentiality, integrity, or availability of the system.

The vulnerability affects Mozilla Firefox versions up to 144, the ESR releases 115.29 and 140.4, and also Mozilla Thunderbird up to version 144 with ESR releases 140.4. Users running any earlier or these specified versions should identify the affected product and apply the corresponding update.

The CVSS score of 9.8 indicates very high severity, while the EPSS of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector involves a malicious or compromised web page that can drive the vulnerable WebGL code path. Successful exploitation could result in local privilege escalation or, if the attacker can influence the privileged process, remote code execution on the host.