This vulnerability arises from incorrect boundary checks in the Layout: Text and Fonts component of Firefox. When the renderer processes certain font files or text metrics, the underlying algorithm can read or write past the expected bounds of a buffer. The consequence may be application crashes, loss of reliability, or, in some scenarios, uncontrolled execution of code through memory corruption. The description does not confirm remote code execution, but the missing checks raise the risk of arbitrary memory manipulation if an attacker supplies crafted input.

All Mozilla Firefox releases prior to version 159, and the ESR 153.6 baseline, are impacted. This includes both standard and extended support releases that lack the patch. The advisory explicitly notes that the issue is fixed in those version numbers, so any Firefox deployment still using older binaries must be updated.

Because the exploitability data is not publicly provided, the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the risk profile is uncertain but not considered widely exploited. The CVSS score is not included, so the assessment relies on the severity of a memory corruption issue. The best course is to apply the official update promptly to eliminate the flaw.