The flaw arises from incorrect handling of buffer boundaries in the Web Codecs component. When a crafted audio or video stream is parsed, the component may read or write outside its allocated memory area. This can corrupt stack or heap data and typically results in a crash, causing a denial of service. The weakness is captured by CWE‑754 (Incorrect Boundary Checks) and CWE‑787 (Out‑of‑Bounds Write).

The vulnerability affects Mozilla Firefox before version 149, as well as the Firefox ESR 140.9 baseline. It also impacts Mozilla Thunderbird before version 149 and the Thunderbird ESR 140.9 release. The issue is present in the standard builds of these products and does not affect other browsers or platforms.

The CVSS base score is 7.5, placing the issue in the high‑severity range. The EPSS score is less than 1 %, indicating a low probability of exploitation in the near term, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to deliver a malicious web page that uses the Web Codecs API to trigger the error. While the out‑of‑bounds access could lead to memory corruption, there is no evidence of a public exploit that escalates to remote code execution, and the current risk is mainly a silent crash of the affected application.