The vulnerability is a use‑after‑free bug in the Graphics: ImageLib component. When an image is processed, the program may dereference memory that has already been freed, allowing an attacker to corrupt memory and potentially execute arbitrary code. This flaw can compromise confidentiality, integrity, and availability of the affected application if successfully exploited. The weakness is classified as CWE-416.

Mozilla Firefox and Thunderbird are affected when running versions older than Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8. All earlier releases lacking these specific patches are vulnerable.

The CVSS score of 8.8 indicates high severity, but the EPSS score is less than 1%, suggesting a low immediate exploitation probability. The vulnerability is not listed in the KEV catalog, meaning no publicly known active exploits have been documented. The likely attack vector is through malicious image content processed by the application, such as downloaded pictures or embedded images in web pages or emails. Exploitation would typically require the attacker to deliver a crafted image that triggers the use‑after‑free during rendering.