An integer overflow was discovered in the Layout: Text and Fonts component of Mozilla products. The flaw stems from an unchecked arithmetic operation that can corrupt memory during the layout of fonts or text, potentially allowing an attacker to influence program state. This weakness is identified as CWE-190, an integer overflow that can lead to memory corruption and unintended behavior.

Mozilla Firefox and Mozilla Thunderbird browsers are affected. All builds prior to Firefox 158 and Firefox ESR 153.5, as well as Thunderbird 158 and Thunderbird ESR 153.5, contain the vulnerability. Later releases include a fix that addresses the integer overflow.

The CVSS score of 5.4 indicates a medium severity vulnerability, and the EPSS score of less than 1 % suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no public exploits have been reported. The likely attack vector involves crafted documents or files that trigger the text layout routine, but the exact conditions for exploitation remain unclear. Overall risk is moderate, and prompt patching is recommended.