The vulnerability is an incorrect boundary check in the graphics Canvas2D component that can lead to out‑of‑bounds memory access, causing memory corruption. When exploited, this could allow an attacker to execute arbitrary code with the privileges of the running user, potentially affecting confidentiality, integrity, and availability of the system. The weakness corresponds to CWE‑754 (Array Index Value Exceeds One More Than Array Length) and CWE‑787 (Out‑of‑Bounds Write).

Mozilla Firefox versions older than 149, Firefox ESR versions older than 115.34 or 140.9, and Mozilla Thunderbird versions older than 149 or 140.9 are impacted. All builds are affected, including ESR channels. The issue is tied to the Canvas2D rendering engine used by both browsers and the email client.

With a CVSS score of 7.5, the vulnerability is classified as high. The EPSS score is below 1 %, indicating that exploitation is considered low probability, and it is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via a crafted web page, email attachment, or malicious content that triggers the Canvas2D rendering path. An attacker would need to deliver the malicious content to a vulnerable user and rely on the boundary conditions to corrupt memory, which may lead to code execution.