The vulnerability stems from undefined behavior that occurs within the audio and video handling component in Mozilla products. The high CVSS score of 9.1 indicates that an attacker could potentially execute arbitrary code or otherwise compromise system integrity by supplying malicious media content to a vulnerable instance.

Mozilla products affected are Firefox and Thunderbird versions earlier than 149. All releases 149 and later are not impacted.

The probability of exploitation is reported to be very low (less than 1%) and the issue has not been listed in the CISA Known Exploited Vulnerabilities catalog. However, given the severity rating, the risk to environments that cannot promptly upgrade remains high. The likely attack path involves an attacker delivering specially crafted audio or video files that trigger the undefined behavior during processing.