The vulnerability in Graphics: ImageLib stems from incorrect boundary checks that allow a crafted image to overflow a buffer. If an attacker delivers such an image, the resulting memory corruption can lead to arbitrary code execution or a denial of service on the affected system.

Mozilla products—Firefox, Firefox ESR, Thunderbird—are impacted. Versions prior to Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8 contain the flaw and are therefore vulnerable.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score is below 1% indicating a low probability of exploitation today, and the flaw is not listed in CISA’s KEV catalog. Exploitation would require an attacker to supply a malicious image, typically through network channels such as email attachments or web content, and it would trigger during the rendering of that image. The impact could be remote code execution or system crash depending on the environment.