An incorrect boundary check in the Graphics: Canvas2D component permits an out‑of‑bounds write when canvas operations exceed the intended buffer limits. This memory corruption can potentially be leveraged by an attacker to corrupt application state, crash the browser or mail client, or in the worst case, execute arbitrary code. The weakness is categorized by CWE-754 and CWE-787, indicating unsafe resize handling and out‑of‑bounds write vulnerabilities, respectively.

Mozilla Firefox versions earlier than 149 and Firefox ESR earlier than 115.34 or 140.9, as well as Mozilla Thunderbird versions earlier than 149 and Thunderbird ESR earlier than 140.9, are vulnerable to this issue.

With a CVSS score of 7.5, this flaw is considered high‑severity. EPSS indicates a very low likelihood of exploitation (<1%), and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation reports. Nevertheless, the potential for remote code execution remains. Based on the component involved and typical attack scenarios for canvas rendering, the likely attack vector is a malicious web page or an email attachment that includes crafted canvas content; this inference is drawn from the nature of the affected component rather than explicit statement in the CVE description.