Incorrect boundary conditions in the WebRTC component used by Mozilla Firefox and Thunderbird can lead to memory corruption, which may enable an attacker to execute arbitrary code on the affected system. The likely attack vector is inferred to be remote network traffic that sends crafted WebRTC packets to the victim, enabling remote code execution (inferred from the description of memory corruption). The weakness represents a classic buffer overflow scenario, potentially enabling both local and remote code execution within the WebRTC pipeline.

Mozilla Firefox and Mozilla Thunderbird are affected. Versions up to 149 in the standard release track and ESR releases prior to 140.10 are vulnerable. The flaw was fixed in Firefox 150 and in the Firefox ESR 140.10 release, as well as in Thunderbird 150 and Thunderbird 140.10.

The CVSS score is 7.3 and the EPSS score of < 1% indicates a low exploitation probability, but because the flaw involves incorrect boundary checks that can trigger memory corruption, the potential impact remains high. No known exploits are publicly documented, and the issue is not listed in the CISA KEV catalog, indicating it has not yet been actively exploited in the wild. Organizations using older Firefox or Thunderbird builds should treat this as a high-risk vulnerability until they can upgrade.