The WebRTC audio/video component contains a flaw in how it processes boundary conditions, which can lead to memory corruption. The CVE description does not explicitly state exploitability, but based on the seriousness of the flaw and the CVSS score of 9.8, it is inferred that an attacker could potentially leverage the corrupted memory to execute arbitrary code, crash the application, or otherwise compromise the affected system. The weakness is classified as CWE‑1384, indicating an error in boundary validation that can corrupt critical data structures.

Mozilla Firefox builds older than 148, as well as ESR releases before 115.33 or 140.8, and Mozilla Thunderbird builds older than 148, plus ESR releases before 140.8, are affected. Users running any of these versions are at risk if WebRTC traffic is enabled or if the application processes media streams from untrusted sources.

The vulnerability has a high CVSS score of 9.8, reflecting critical severity. However, the EPSS score is below 1%, suggesting a low probability of exploitation in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, inferred from the WebRTC component's exposure to network media streams; an adversary could deliver a malicious media payload via a web page or other remote source to trigger the faulty boundary handling.