This vulnerability arises from incorrect boundary checks in the audio/video component of Mozilla Firefox and Thunderbird, leading to an integer overflow. The flaw was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151 and Thunderbird 140.11. The advisory does not specify the exact impact, but the CVSS score of 7.5 indicates a high severity.

All installations of Mozilla Firefox older than version 151, and all ESR releases before 140.11, as well as all installations of Mozilla Thunderbird older than version 151 or ESR releases before 140.11, are affected. The flaw exists across all supported operating systems, so any user running a legacy version of Firefox or Thunderbird is at risk.

Exploit availability data is not published; the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. The high CVSS score indicates significant potential impact, and the flaw resides in media handling code that is executed for every media stream. The likely attack vector, based on the nature of the component, is remote via delivery of a crafted media file (for example, embedded in a malicious web page or email attachment). Because no public exploit is known, the exact likelihood of exploitation remains uncertain, but the risk is considered high enough to warrant prompt mitigation.