The vulnerability is a use‑after‑free flaw located in the WebRTC Audio/Video component of Mozilla products. This flaw can corrupt memory in the browser or mail client when a WebRTC media stream or content containing the vulnerable code is processed. The memory corruption could be exploited by an attacker to gain arbitrary code execution or, at a minimum, to crash the application. This type of weakness is reflected by CWE‑416 and CWE‑825.

Mozilla Firefox versions 153 and the Firefox ESR 140.13 line, as well as Mozilla Thunderbird versions 153 and the Thunderbird ESR 140.13 line, are affected. No earlier versions are listed as vulnerable.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests a low current probability of exploitation. The flaw is not listed in the CISA KEV catalog, implying no known active exploitation. It is inferred that the attack vector is remote, likely via a malicious WebRTC media stream or a web page that triggers the flaw, but the description does not explicitly provide the exact exploitation method.