An attacker who can influence the encrypted media processing pipeline can corrupt memory inside the GMP process, a sandboxed component of Mozilla applications. This overflow type flaw, identified as CWE‑119, allows a sandbox escape that can give the attacker arbitrary code execution or privilege escalation within the user’s system. The severity is high, reflected in the CVSS score of 9.8, because once the sandbox is breached, the attacker can run any code with the same rights as the application.

Mozilla Firefox and Mozilla Thunderbird are affected. Versions prior to Firefox 142, Firefox ESR 115.27, 128.14, and 140.2, as well as Thunderbird 142, 128.14, and 140.2, are vulnerable. The fix is available in the listed releases and later. All other Mozilla products not listed here are not reported to be affected.

The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild at the time of this analysis. However, the CVSS of 9.8 highlights a maximum impact if exploited. The vulnerability is not currently listed in the CISA KEV catalog, meaning that there is no widespread evidence of active exploitation, but the attack vector is a memory corruption in a sandboxed media component, which requires content that triggers the bad pointer handling. The combination of high severity and limited exploitation probability suggests a high-impact, low-probability risk profile.