Incorrect boundary conditions in the Audio/Video: Playback component allow the component to access memory outside the intended bounds, potentially leading to corruption of memory and system instability. The description does not confirm remote code execution or further exploitation but indicates a serious flaw that could be leveraged by an attacker with a malicious media file.

Mozilla Firefox prior to version 159, and Firefox ESR versions before 115.44 and before 153.6 are affected. The vulnerability was fixed in Firefox 159, Firefox ESR 115.44 and Firefox ESR 153.6, so systems running these or earlier versions are vulnerable.

The CVSS score is not provided, the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker could provide a crafted media file to a user of the affected installer, potentially triggering memory corruption. Because no public exploit is known and the vulnerability is not cataloged, the immediate risk is uncertain, yet the severity of the flaw warrants prompt remediation.