Technical impact
Incorrect boundary conditions were identified in the Audio/Video: Playback component of Mozilla Firefox and Thunderbird. The flaw allows the browser to read or write outside the intended memory bounds when decoding media files, which can cause the application to crash or exhibit erratic behavior. The primary consequence is a denial of service, as affected users may experience disruption or termination of media playback. While memory corruption could theoretically be escalated, the vulnerability description does not confirm arbitrary code execution.
Affected Systems
Mozilla Firefox and Thunderbird are affected in all releases older than Firefox ESR 115.42, Firefox ESR 140.17, Firefox ESR 153.4, and the standard release Firefox 157, and Thunderbird ESR 140.17, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157. Users on earlier builds remain vulnerable until they upgrade to any of the patched releases mentioned.
Risk and Exploitability
The issue is not listed in CISA’s KEV catalog and no exploit has been published, indicating a low or moderate risk footprint. The EPSS score is < 1%, suggesting a very low probability of exploitation, but the CVSS score of 8.1 indicates a high severity impact. Based on the description, it is inferred that the bug can be triggered by playing a malformed media file in both Firefox and Thunderbird, meaning the likely attack vector involves a user opening or streaming such content. Exploitation would require the attacker to supply specialized media to the victim or host it via a web page that forces playback.
Debian DLA
Debian DSA