This vulnerability arises from incorrect boundary checks within the Graphics: Canvas2D component, allowing an attacker to exploit an out‑of‑bounds memory write. The resulting memory corruption could enable arbitrary code execution or, at minimum, a denial of service if triggered by malicious content rendered in the browser or email client.

Mozilla Firefox and Thunderbird are the affected products. Versions prior to Firefox 149 and Firefox ESR 115.34 or 140.9 are vulnerable, as are Thunderbird versions prior to 149 and Thunderbird ESR 140.9. All other versions released after these patches are considered safe.

The CVSS score of 7.5 indicates a high impact, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require a crafted web page or an email containing malicious Canvas2D content, and the attacker would need to deliver that content to a user’s browser or Thunderbird client.