The flaw originates from incorrect boundary checks in the Graphics: Text component, which can result in buffer overflows and unsafe memory access. This weakness is identified as CWE‑119, CWE‑754, and CWE‑805. If successfully exploited, an attacker could cause a crash or execute arbitrary code within the context of the process.

Mozilla Firefox versions earlier than 149 and Firefox ESR 140.9, as well as Mozilla Thunderbird earlier than 149 and Thunderbird ESR 140.9 are vulnerable. The issue resides in the graphics text rendering subsystem used by both the browser and the mail client.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score of less than 1% suggests a low likelihood of widespread active exploitation, and it is not listed in the CISA KEV catalog. Nonetheless, the attack requires an attacker to supply crafted content—such as malicious web pages or phishing email attachments—that triggers the boundary violation. Once triggered, the resulting memory corruption could lead to denial‑of‑service or arbitrary code execution depending on the environment and the attacker’s skill.