Mozilla Firefox contains a flaw where the Audio/Video component reads memory that has not been initialized, allowing an attacker to read that content and potentially obtain sensitive data. The vulnerability does not provide a path to execute arbitrary code or elevate privileges, but it can expose confidential information contained in memory at the time of the read. The flaw is classified as a weakness in memory handling (CWE‑788) and results in unintended information disclosure (CWE‑200).

All Mozilla Firefox releases prior to the fixed versions are affected. The fix was applied in Firefox 159 and in the ESR releases 115.44 and 153.6, so any version older than those releases may still contain the uninitialized memory bug.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, indicating that the known exploitation probability is not publicly estimated. Because the issue results in data leakage rather than code execution, the risk level is moderate to high depending on the sensitivity of the data that could be read. The attack vector is not explicitly documented, but it would require the attacker to generate a media payload that triggers the component to access uninitialized memory, so local or inbound media access is the likely pathway.