The vulnerability arises from incorrect boundary checks in the audio/video playback component, which permits an integer overflow during media processing. The overflow can corrupt internal memory and trigger application crashes, as noted by the official advisory. This leads to a loss of availability and potential integrity issues; no evidence of code execution is provided.

Mozilla Firefox and Mozilla Thunderbird builds before version 150 of each product are affected. The flaw was addressed in Firefox 150 and Thunderbird 150, so any earlier release remains vulnerable.

The CVSS score of 5.3 classifies the issue as medium severity. EPSS information is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating limited or no public exploitation to date. An attacker could exploit the integer overflow by supplying a crafted media file to the browser or email client, causing a crash and a denial of service, but no remote code execution vector is reported.