The flaw arises from incorrect boundary handling in the Web Audio component, creating a buffer over-read/write that can crash the browser or enable arbitrary code execution. This boundary error is catalogued as CWE-119 and can be leveraged by a malicious web page or email containing a crafted AudioContext to corrupt memory or trigger an exploit. As a result, an attacker could compromise the confidentiality, integrity, and availability of the affected system.

Mozilla Firefox users running any version prior to Firefox 148, including ESR builds older than versions 115.33 and 140.8, are impacted. Similarly, Thunderbird users on versions before Thunderbird 148, including ESR builds older than 140.8, are at risk.

With a CVSS score of 9.8 the vulnerability is classified as critical, yet the EPSS score of less than 1% indicates a low likelihood of exploitation at this time. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is inferred to be a user accessing a malicious web page or opening a crafted email that exploits the Web Audio API; an attacker must first entice a vulnerable user to load the content. No mitigations are documented beyond remediation by an update, so the exposure persists until the affected products receive a patch or the component is disabled.