Based on the description, it is inferred that the audio and video playback component has incorrect boundary checks, which can allow the parser to read beyond the intended buffer when processing malformed media files. While the update does not explicitly mention a crash or data leak, such an over‑read can cause a memory corruption event that may lead the application to crash or expose unexpected data.

The vulnerability affects all releases of Mozilla Firefox and Thunderbird that use the legacy audio/video playback component before the patch was applied. Specifically, any version of Firefox older than 150, any version of Thunderbird older than 150, any ESR 115.x release older than 115.35.2, and any ESR 140.x release older than 140.10.1 is susceptible. Users should verify that their build precedes those fixed versions and apply the corresponding update.

The EPSS score is < 1% and the issue is not listed in CISA’s KEV catalog, so the current exploitation probability is low. The CVSS score of 9.8 indicates a critical severity, confirming that memory corruption in a browser component is a high‑risk vulnerability. Based on the description, it is inferred that the likely attack vector is delivering a malformed media file via a webpage or malicious download, potentially triggering a crash or data leak. The risk is elevated for environments that routinely encounter untrusted media content, and timely remediation is advised.