The vulnerability arises from incorrect boundary checks in Mozilla’s graphics component. The failure to enforce proper bounds can lead to buffer over‑reads or over‑writes of memory. Such memory corruption is identified by CWE‑754 and CWE‑787, and can permit an attacker to execute arbitrary code or cause a crash, disrupting the affected application or compromising system integrity.

The defect applies to all pre‑149 releases of Mozilla Firefox and to Firefox ESR versions before 140.9. It also affects all pre‑149 releases of Mozilla Thunderbird and Thunderbird ESR versions before 140.9. All affected components were patched in the fixed releases identified in the CVE record.

With a CVSS score of 7.5 this flaw is considered moderate‑to‑high severity. The EPSS score of less than 1 % suggests a low likelihood of exploitation in the near term, and it is not listed in the CISA KEV catalog. An attacker could plausibly exploit the issue through a malicious script or document that forces the application to render crafted graphics, potentially resulting in remote code execution or denial of service, depending on user privileges.