This vulnerability arises from incorrect boundary conditions in the Layout: Text and Fonts component. The flaw can cause uncontrolled memory writes, which may overwrite sensitive data and give an attacker the ability to execute arbitrary code within the context of the application. The primary impact is therefore a compromise of confidentiality, integrity, and availability of the affected system.

The affected products are Mozilla Firefox and Mozilla Thunderbird. Versions prior to Firefox 149, Firefox ESR 115.34 and 140.9, Thunderbird 149, and Thunderbird 140.9 are vulnerable. All newer releases contain the fix.

The CVSS score is 7.5, indicating high severity. EPSS is reported as less than 1%, suggesting a low probability of exploitation. It is not listed in CISA's KEV catalog. The likely attack vector involves crafted content rendered by the application; based on the component involved, the attack is inferred to be executed when the user opens a malicious web page or document that triggers the layout engine. No explicit vector is described in the input, so this inference is made from the nature of the component.