The vulnerability is a use‑after‑free error in the WebRTC audio and video processing component that can corrupt memory after a reference to freed memory is accessed. This flaw falls under CWE‑416 and CWE‑825 and could enable an attacker to execute arbitrary code, compromise the host or cause a denial of service by crashing the application. The official description does not cite a specific exploitation path, but the high CVSS score reflects the potential for severe impact.

This vulnerability affects Mozilla Firefox versions prior to 145, including Firefox ES‑R versions before 140.5, and also Mozilla Thunderbird versions before 145 and Thunderbird ES‑R before 140.5. Users running any of the affected releases of these browsers are exposed.

The CVSS score of 8.8 classifies the flaw as high severity, while an EPSS score of less than 1 % indicates that active exploitation attempts are currently uncommon. Because the bug resides in client‑side media handling, an attacker would typically need a victim to load a crafted WebRTC stream, such as by visiting a malicious website or opening a malicious attachment. Based on the description, it is inferred that the likely attack vector is to lure a user into processing a malicious WebRTC stream. This scenario is not listed in the CISA KEV catalog, but the combination of high severity and the possibility of remote code execution warrants preemptive mitigation.