Mozilla’s Firefox and Thunderbird include a graphics component that incorrectly handles uninitialized memory, allowing an attacker to escape the sandbox that confines the browser and mail client. The flaw can enable arbitrary code execution or elevation of privileges beyond the application’s protected environment. The weakness is categorized as CWE-908, reflecting an uninitialized memory use condition.

All releases of Firefox older than 158, the ESR 115.43 and ESR 153.5 builds, and all Thunderbird versions older than 158 or earlier ESR 115.43 and ESR 153.5 contain the vulnerability. Users who have not upgraded to a fixed build remain at risk.

Based on the description, it is inferred that the likely attack vector is the delivery of untrusted content rendered by the browser or mail client—such as a malicious web page, plugin, or mail attachment—that triggers the graphics subsystem’s uninitialized memory usage. The EPSS score is less than 1% and the CVSS score is 7.1, indicating high severity but relatively low expected exploitation probability. The flaw is not listed in the CISA KEV catalog. Because of the remote nature of the attack and the potential impact, prompt action is recommended.