The vulnerability arises from a buffer overflow (CWE‑119) caused by incorrect boundary conditions in the WebRTC component. It also involves unsafe buffer access (CWE‑787) that can lead to memory corruption. Crafted data can exceed expected limits, resulting in process crashes that can deny service to users. No information indicates that the flaw leads to arbitrary code execution, but repeated crashes could facilitate broader denial of service attacks or provide a foothold for attackers to trigger additional vulnerabilities if exploited in a chained manner.

Mozilla Firefox and Mozilla Thunderbird versions earlier than 150 are affected; the fix was implemented in those products starting with version 150.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score is not available, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no public exploits have been reported. The likely attack vector is via crafted WebRTC packets sent over the network; this inference is based on the component affected. Given the absence of active exploits and the moderate CVSS score, the overall risk remains low to moderate, but the potential for service disruption warrants timely remediation.