This vulnerability arises from undefined behavior in the audio/video component of the application. Undefined behavior can result in memory corruption, which may allow an attacker to compromise the integrity of the running process or trigger a crash. The high CVSS score of 9.1 reflects the severity of the potential impact, indicating that a successful exploitation could have significant consequences for confidentiality, integrity, or availability of user data.

Mozilla Firefox and Mozilla Thunderbird are affected. All releases prior to version 149 contain the flaw; the issue is fixed in Firefox 149 and Thunderbird 149.

The CVSS score indicates a severe vulnerability, while the EPSS score of less than 1% suggests that exploit activity is currently rare. The vulnerability is not listed in the CISA KEV catalog. Based on the component involved, the likely attack vector involves the processing of malicious audio or video content that could be delivered remotely or locally, but this inference is drawn from the description and the nature of the component, not from explicit input.