The vulnerability involves incorrect boundary checking in the Web Codecs component, which can lead to memory corruption such as integer overrun or underread. Based on the description, it is inferred that a crafted codec stream delivered by a malicious web page could trigger the flaw, potentially causing a crash or, depending on the memory layout, enabling an attacker to execute code. The description itself does not confirm arbitrary code execution, but the nature of the memory corruption makes this outcome plausible.

All versions of Mozilla Firefox older than 151, including Firefox ESR 115.36 and ESR 140.11, are affected, as are all versions of Thunderbird older than 151, including Thunderbird ESR 140.11. Users running those releases and accessing the Web Codecs API in web pages that handle media streams may be at risk.

The CVSS score of 7.5 indicates high severity. The EPSS score of 0.037% indicates very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote malicious web page that delivers a specially crafted Web Codec payload, constituting a remote attack scenario. While the defect can cause memory corruption, no public exploit has been documented, so real‑world exploitation risk remains uncertain pending further analysis.