A critical boundary condition flaw in the Graphics component of Mozilla Firefox and Thunderbird may lead to application crashes or denial of service.

The vulnerability resides in the Graphics component, where incorrect boundary conditions allow an unauthenticated, remote attacker to trigger a denial of service condition.

The CVSS score of 7.5 indicates a high severity risk, primarily due to the potential for service disruption. Successful exploitation allows an attacker to crash the browser or email client remotely, which can lead to significant productivity loss, operational downtime, and potential disruption of secure communication workflows.

Immediate Action: Update Mozilla Firefox and Thunderbird to version 149 or the 140.9 ESR release immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs and endpoint crash reports for recurring application failures that correlate with the Graphics component.

Compensating Controls: Ensure that endpoint protection software is active and fully updated to detect and block malicious payloads that might attempt to leverage browser vulnerabilities.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the ease of exploitation for this high-severity flaw, organizations should prioritize deploying the vendor-supplied updates to all affected endpoints. Failure to patch these browsers leaves users exposed to potential denial of service attacks that could interrupt critical business operations.