The flaw arises when the Graphics: WebRender component can run out of memory during normal operation, causing the browser to become unresponsive or crash. This leads to a denial of service that affects only the affected user's session or machine, but can be exploited by displacing resources. The weakness is identified as an uncontrolled resource consumption issue.

Mozilla Firefox and Thunderbird are affected. Any release before Firefox 142 or the ESR 140.2 line, and any Thunderbird release before 142 or the ESR 140.2 line, are vulnerable. The issue specifically impacts the WebRender rendering subsystem used by these products.

The CVSS score of 7.5 indicates a high impact level. EPSS is below 1%, implying the exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via a malicious web page or email attachment that triggers rendering of complex or malformed graphics content. Requiring the product to process such content will exhaust memory and force a crash, resulting in a service availability loss for the user. No known exploitation of confidentiality or integrity properties is documented.