Uninitialized memory within the Graphics: Canvas2D component can allow an attacker to influence memory used during rendering, potentially leading to arbitrary code execution or disclosure of sensitive data. The flaw arises from improper initialization of internal buffers when a Canvas2D instance processes input from a web page or email attachment. The high CVSS score of 9.1 indicates that, if exploited, an attacker could push the application into an unsafe state and execute code of their choosing.

Mozilla Firefox releases older than 149 and ESR versions below 140.9, as well as Mozilla Thunderbird releases older than 149 and ESR versions below 140.9, are affected. Versions starting with Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9 contain the fix and are considered safe.

The vulnerability carries a CVSS score of 9.1 and an EPSS probability of less than 1 %, suggesting a low likelihood of exploitation but a severe potential impact. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote: a malicious web page or email attachment that triggers Canvas2D rendering could exploit the flaw, as inferred from the exploit model and the component involved. Organizations should treat this as a critical risk until a patch is applied.