The vulnerability involves an invalid pointer within Mozilla Firefox's graphics subsystem, which can trigger memory corruption when the browser processes graphics data. This flaw can cause the browser to crash, potentially leading to a denial‑of‑service situation for the user. The description does not state that arbitrary code execution is possible, so any execution risk is uncertain.

Affected products are Mozilla Firefox versions prior to 159 on the regular channel, prior to 153.6 on the ESR channel, and Mozilla Thunderbird versions prior to 159 on its regular channel, and prior to 153.6 on its ESR channel. Users running those versions without the vendor's fix are susceptible.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation. The CVSS score is not provided. Based on the description, the likely attack vector would involve an attacker delivering malicious content that exercises the graphics subsystem, possibly through a web page or a crafted file. The precise exploitation likelihood remains unknown due to the absence of publicly observed attacks.