This flaw in the Graphics component of Mozilla Firefox and Thunderbird permits an attacker to gain elevated privileges by exploiting incorrect boundary checks. The CVE description does not explicitly detail the exploitation mechanism; it is inferred that a crafted graphics request could trigger the flaw and elevate rights within the browser process.

The affected products are Mozilla Firefox and Mozilla Thunderbird. The fix appears in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17, and in Thunderbird 140.17, Thunderbird 157, and Thunderbird 153.4. Versions of Firefox or Thunderbird older than these releases are potentially vulnerable.

The CVSS score of 8.8 indicates a high severity vulnerability, and the EPSS score is below 1%, so the precise likelihood of exploitation remains uncertain. The vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation at the time of this analysis. Privilege‑escalation flaws typically carry high severity, and an attacker capable of triggering the boundary condition could potentially compromise the system. The attack vector is inferred to be local or web‑based, requiring the execution of a crafted graphics request to exploit the flaw.