Incorrect boundary conditions in the SVG component could allow an attacker to read or write memory beyond intended boundaries when processing SVG content, a flaw identified as a buffer overrun (CWE-119). The flaw may lead to memory corruption, which could compromise confidentiality, integrity, or availability on the affected system.

Mozilla Firefox users on versions prior to 158, including any ESR release earlier than 153.5, as well as Mozilla Thunderbird users on versions before 158 (including any ESR before 153.5), are affected. The vulnerability was addressed in Firefox 158/ESR 153.5 and Thunderbird 158/153.5.

EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and it is not listed in the CISA KEV catalog. The CVSS score of 8.8 indicates a high severity vulnerability. Attack details are not explicitly provided, but it is inferred that malicious SVG content supplied via a web page, an email attachment, or a local file could trigger the vulnerability. The likelihood of exploitation remains uncertain because specific vectors or prerequisites are not disclosed.