A flaw in the graphics component allows incorrect handling of boundary conditions, which can lead to a sandbox escape. Exploitation would give an attacker the ability to execute arbitrary code outside the confined environment of the application, potentially compromising the entire host system or any processes the user runs. The vulnerability is a classic example of unsafe memory manipulation under CWE-119, which directly threatens confidentiality, integrity, and availability of the affected machine.

Mozilla products including Firefox and Thunderbird are affected. The issue exists in all releases of Firefox and Thunderbird predating the security fixes. The fixes were rolled out in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7, so any version older than those is vulnerable.

The CVSS score of 9.8 marks it as a critical severity. However, the EPSS score of less than 1% indicates a low current exploitation probability. It is not listed in the KEV catalog, implying no confirmed active exploits at the moment. The attack vector is likely local or remote content exploitation; a malicious web page or message that renders graphics could trigger the boundary check bypass. Given the lack of known public exploits, the risk remains primarily theoretical, but the severity calls for rapid action.