The flaw is an undefined‑behaviour vulnerability in the WebRTC Signaling component of Mozilla products. The issue originates from code that processes signaling data, but the description does not specify the exact result of the flaw. Undefined behavior can lead to crashes, data corruption, or other unpredictable effects when the component encounters malformed input.

Mozilla Firefox versions older than 149 and the ESR branch older than 140.9, as well as Mozilla Thunderbird versions older than 149 and the ESR branch older than 140.9, are affected by this vulnerability. The same WebRTC implementation is utilized in both the browser and the mail client, meaning the impact applies to all affected installations of either product.

The CVSS score of 9.8 categorizes the vulnerability as critical, while the EPSS score indicates that active exploitation is currently uncommon. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, so no publicly known exploits are documented. The attack vector is not explicitly described in the available data; based on the component’s role, it is reasonable to infer that the flaw can be triggered by external entities that deliver WebRTC signaling traffic, though the precise method to achieve exploitation is not detailed.