The vulnerability comes from an uninitialized memory read in the Audio/Video component. When the component processes data that has not been explicitly initialized, it can inadvertently read residual data, potentially leaking information or triggering crashes. This leak can expose sensitive user information and compromise the stability of the application.

Mozilla Firefox and Mozilla Thunderbird products are affected. All releases older than the patched versions—Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 140.17, Thunderbird 153.4, and Thunderbird 157—contain the flaw. Any build prior to these fixes is considered vulnerable.

The CVSS score of 4.3 places the vulnerability in the moderate risk range, reflecting its potential to expose data or cause instability. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector would involve a malicious media file or a web page that triggers the Audio/Video component, though this inference comes from the nature of the component rather than explicit evidence.