Incorrect boundary conditions were discovered in the WebRTC component of Mozilla Firefox. This flaw can lead to memory corruption and, based on the nature of boundary checks, could be exploited to execute arbitrary code within the browser context. The vulnerability was fixed in Firefox 159 and the ESR 153.6 release.

All versions of Mozilla Firefox older than 159, including the ESR 153.6 series, are affected. Clients using these outdated browsers are vulnerable until they upgrade to a patched version.

No CVSS or EPSS score is publicly available, and the vulnerability is not listed in the CISA KEV catalog, so the current exploitability in the wild remains unknown. Given the critical role of WebRTC in browsers, however, this defect poses a potential for remote exploitation if an adversary can supply malicious WebRTC traffic.