An incorrect boundary condition in the Audio/Video component of Firefox and Thunderbird can lead to an out‑of‑bounds write that, if triggered, may allow an attacker to execute arbitrary code. The compromise would grant full control of the affected process, potentially leaking or altering user data and providing a foothold for further attacks.

The vulnerability is present in all releases of Mozilla Firefox and Mozilla Thunderbird that are older than Firefox 149 and Firefox ESR 140.9, and older than Thunderbird 149 and Thunderbird ESR 140.9. Any system running those versions on any platform can be impacted unless mitigated by a patch.

The CVSS score of 9.8 signals a high severity. The EPSS score is below 1 %, indicating that the craft of an exploit may currently be uncommon, but the impact remains significant. The flaw is not listed in CISA’s KEV catalog. The likely exploit path is a crafted audio or video file that triggers the overflow when processed by the browser or mail client, potentially allowing remote code execution from a malicious website or from locally opened media. This inference is based on the nature of the affected component and the typical attack vectors for such vulnerabilities.