The reported issue is incorrect handling of boundary conditions within the Web Audio component. This flaw could result in memory corruption if an attacker supplies crafted audio data that triggers invalid buffer access. The specific impact is not detailed in the advisory, but such corruption could potentially lead to execution of arbitrary code or denial‑of‑service, depending on how the corrupted memory is interpreted. These possibilities are inferred because the advisory does not explicitly state the outcome of exploitation.

The vulnerability affects Mozilla Firefox versions older than 152 and the Firefox Extended Support Release 140.12, as well as Mozilla Thunderbird versions older than 152 and the Thunderbird Extended Support Release 140.12. Users running any earlier release are potentially vulnerable.

The EPSS score is reported as less than 1%, indicating a low probability of active exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Because the advisory mentions fixes in new releases, CVSS score 8.1 indicates high severity, but the low exploit likelihood suggests that the risk is currently moderate until an exploit becomes available. The lack of an explicit exploitation vector in the advisory makes it difficult to assess the exact attack path; it is inferred that a malicious web page or email containing crafted audio payload could be used to trigger the boundary error, but this inference is not confirmed by the CVE description.