The flaw originates from incorrect boundary checks in the Audio/Video component of Mozilla Firefox and Thunderbird, potentially allowing sensitive data to be read from memory. Identified as a buffer overrun weakness (CWE‑119) and an out‑of‑bounds read (CWE‑125), the description does not specify the exact exploitation method, but suggests that improperly handled boundaries in media decoding could leak confidential information.

Mozilla Firefox installations with versions older than 150.0.1, Firefox ESR 140.10.1, or Firefox ESR 115.35.1, and Thunderbird installations with versions older than 150.0.1 or Thunderbird ESR 140.10.1, are impacted. The issue affects the media decoding code used by any enabled codec or plugin in those applications.

The CVSS score of 7.5 reflects a high impact. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is below 1%, indicating a low probability of exploitation. The likely attack vector is inferred to involve delivery of malicious audio or video content to the browser during playback or download; this inference is based on the description of boundary conditions in the decoding process. Once triggered, the flaw may enable an attacker to read sensitive information from memory. Applying the official patch removes the risk.