An error in the handling of boundary conditions within the WebRTC Signaling component could allow an attacker to supply malformed signaling data that causes the browser to read or write outside of allocated memory. The result would be a crash or unexpected termination of the browser process, leading to a denial of service. The vulnerability does not specify any remote code execution or escalation, so its primary impact is service disruption rather than privilege elevation.

Mozilla Firefox and Thunderbird are affected. The vulnerability exists in versions prior to 159 for the mainline, and prior to 153.6 for the ESR branch for both products. It was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird ESR 153.6.

The CVSS score and EPSS are not provided, and the vulnerability is not listed in CISA KEV, so the exploitation probability is unclear from disclosed data. Based on the description, the likely attack vector is a crafted WebRTC signaling message delivered from a malicious web page or script, which an attacker could inject into a victim’s browser to trigger the crash. While the impact is significant for end‑users and may affect availability of web services, the lack of an exploit reference suggests that exploitation is not confirmed but remains possible if an attacker can reach the vulnerable code path.