The vulnerability arises from incorrect boundary checks inside the graphics rendering engine, causing an unsigned integer overflow that can corrupt memory. This weakness, formalized as CWE‑190 and CWE‑754, may let an attacker leverage crafted graphics or image data to trigger the overflow, potentially leading to arbitrary code execution or a denial‑of‑service condition.

All releases of Mozilla Firefox older than 149, including both mainstream and ESR builds before 115.34 and 140.9, as well as all versions of Thunderbird older than 149, including ESR builds before 140.9, are impacted. These products run on all major operating systems, as the vulnerable code resides in the shared graphics library.

The CVSS v3.1 score is 7.5, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to supply a malicious image or graphics payload—potentially via a web page or a local file—to trigger the overflow. Although no confirmed wild exploits have been reported, the combination of memory corruption and high severity warrants timely remediation.