An integer overflow within the graphics subsystem can cause the sandbox that normally isolates web content or email attachments to escape, allowing code to run with the privileges of the host application. This flaw, identified as CWE‑190, does not inherently grant unrestricted code execution, but it enables the attacker to break out of the sandboxed environment used by Firefox or Thunderbird.

All versions of Mozilla Firefox released before 147, as well as the ESR releases prior to 115.32 (Firefox ESR 115) and prior to 140.7 (Firefox ESR 140), are vulnerable. The same applies to Thunderbird versions preceding 147 and the ESR 140.7 release. Users running these older builds need to upgrade to a patched version to eliminate the integer‑overflow weakness.

The CVSS score of 8.8 reflects a high severity. However, the EPSS indicates a low exploitation probability (less than 1 %). The vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely trigger the overflow by supplying malicious graphics or image data, such as on a compromised web page or through a crafted email attachment; this inference is based on the nature of the flaw.