The vulnerability allows an attacker to induce a denial‑of‑service condition within the WebRTC signaling subsystem. By issuing specially crafted signaling messages, an adversary can exhaust system resources, causing the browser or mail client to hang or crash. The flaw does not compromise confidentiality or integrity; its effect is purely availability loss, classified as a high‑severity resource‑exhaustion problem.

Mozilla's Firefox web browser and Thunderbird mail client are affected. The issue is present in all releases before Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9, all of which have issued a fix in the stated versions.

With a CVSS score of 7.5, the flaw is considered high. The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the vulnerability has not been catalogued in the CISA Known Exploited Vulnerabilities list. The attack likely requires the victim to receive or interact with malicious WebRTC signaling traffic, which can occur during normal use of the browser or mail client. Because the vector is remote, the potential scale of impact is many users, but remediation is straightforward.