An invalid pointer in the Graphics component of Mozilla Firefox allows an attacker to gain elevated privileges on the host system. The vulnerability arises from the improper handling of memory during graphics processing, enabling an attacker to execute code with the privileges of the browser process. This flaw can lead to full system compromise, as the browser typically runs with the user's credentials, and the memory corruption can be leveraged to escape sandbox controls.

Versions of Firefox before 154 on the standard release channel and before 153.1 on the Extended Support Release (ESR) channel are impacted. The flaw exists across all platforms where the Graphics component is active, including Windows, macOS, and Linux distributions.

The CVSS score is not provided in the available data, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves local exploitation through graphics content rendering, such as images or web pages. While exploitation may require user interaction to trigger graphics processing, the potential for privileged code execution makes it a high‑severity risk for affected users.