The flaw arises from incorrect boundary checks in the Audio/Video: GMP component, which can create a buffer overflow. Based on the description, it is inferred that this overflow could allow an attacker to execute arbitrary code while media data is processed, potentially compromising the application and the underlying system.

Vulnerable products include Mozilla Firefox and Mozilla Thunderbird. The affected releases are Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users who have not applied a newer version remain at risk.

The CVSS score of 9.8 indicates a very high severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exposure to crafted media, such as a malicious web page or an email attachment that forces the GMP subsystem to process forged media data. Although exploitation is possible, the overall risk profile recommends immediate mitigation.