The flaw is caused by incorrect boundary conditions in Firefox's SVG component, which can lead to memory corruption when a malicious SVG file is processed. This type of mistake typically allows arbitrary code execution or denial of service if the attacker can supply a crafted image. No additional detail is provided in the official description, so the exact privilege level or scope of compromise remains unclear.

Mozilla Firefox, any release before 158.0.1. The vulnerability is specific to this browser version and its SVG handling logic.

The CVSS and EPSS metrics are unavailable, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits at this time. The primary attack vector would be through the delivery of a crafted SVG file, possibly via a web page or local file. Because of the lack of public exploitation evidence and the lack of severity metrics, the likelihood of immediate risk is low, but the potential impact remains serious if an exploit were discovered.