This vulnerability arises from an integer overflow caused by incorrect handling of boundary conditions in the Graphics component. The overflow can corrupt memory, potentially allowing an attacker to execute arbitrary code or cause a denial of service by triggering a crash. The flaw falls under the weaknesses of integer overflow and incorrect boundary conditions.

Mozilla products are affected, including Firefox versions earlier than 149, the Firefox Extended Support Release before 115.34 and before 140.9, and Thunderbird before version 149, as well as Thunderbird ESR releases below 140.9. Users running any of these outdated releases are at risk.

The CVSS score of 7.5 indicates a high severity impact, but the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. An attacker would most likely need to deliver malicious content that forces the Graphics component to process large or malformed data, so the attack vector would be remote via crafted images or web content.