Mozilla Firefox EUVD-2026-98648

Exploitation requires the victim to use Firefox and to load attacker-controlled content that is processed by the Graphics component (e.g., visiting a malicious or compromised web page), as reflected by UI:R in the CVSS vector - this user-interaction requirement is the primary limiting factor and rules out zero-click/drive-by exploitation. No authentication is required (PR:N), and no special non-default configuration is indicated in the description. The window is limited to unpatched versions prior to Firefox 158, ESR 115.43, and ESR 153.5; systems on those fixed builds are not exploitable.

This is a legitimate high-severity client-side vulnerability but not a top-priority emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction - consistent with a browser victim visiting a malicious or compromised web page. The signals are internally consistent: CWE-190 integer overflow in the Graphics component plausibly leads to memory corruption and full C/I/A impact, matching the 'Integer Overflow'/'Buffer Overflow' tags. However, the exploitation-probability signals argue against imminent mass exploitation: EPSS is only 0.16% (5th percentile), the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced. No SSVC decision data was provided. Net: a serious memory-safety browser bug that warrants prompt patching in the normal update cycle, but there is no evidence of active exploitation or weaponization at this time. Note the UI:R requirement meaningfully limits drive-by risk compared to a zero-click flaw.

An attacker hosts a web page containing crafted graphics content that triggers the integer overflow in Firefox's Graphics component when rendered. A user is lured (via phishing, malvertising, or a compromised site) into visiting the page, and the resulting memory corruption could allow arbitrary code execution in the browser's context. No public exploit code has been identified at time of analysis, so exploitation would currently require independent development.