A defect in the graphics handling code of Mozilla’s browsers and email client can cause the applications to become unresponsive or crash when processing certain graphics. This results in a loss of availability for the user. The weakness is classified as CWE-770, indicating a memory allocation issue that can be exploited through crafted rendering requests. No privilege escalation is achieved, and the flaw resides in user‑level code.

Mozilla Firefox versions before ESR 153.4 and before 157, and Mozilla Thunderbird versions before 153.4 and before 157, are affected. Each build of the affected products that does not include the graphics component patch can be impacted. Newer releases that contain the update are not vulnerable.

The CVSS score of 6.5 labels the vulnerability as medium severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation at this time, and the weakness is not listed in the CISA KEV catalog. The likely attack path requires the delivery of a specially crafted graphic or rendering request to the application, but an attacker does not need elevated privileges to trigger the denial.