A critical boundary condition vulnerability in Mozilla Firefox and Thunderbird exposes users to potential service disruption through unauthenticated remote exploitation.

This flaw exists within the Audio/Video Web Codecs component, where incorrect boundary checks can be triggered by an unauthenticated attacker. The vulnerability is characterized by a high impact on system availability, allowing for potential crashes or hangs.

The exploitation of this vulnerability results in a denial of service, which can significantly disrupt business operations and user productivity. Given the CVSS score of 7.5, this high severity flaw poses a substantial risk to organizational continuity. Unauthenticated attackers can trigger this remotely, making it a priority for organizations relying on these browsers for daily workflows.

Immediate Action: Update all installations of Mozilla Firefox and Thunderbird to version 149 or, if utilizing the Extended Support Release, to version 140.9.

Proactive Monitoring: Monitor endpoint logs for abnormal browser application crashes or frequent service restarts that may indicate attempted exploitation.

Compensating Controls: Ensure that browser-based security policies are enforced and consider deploying network-level traffic inspection to block suspicious multimedia streams that may target the Web Codecs component.

Public Exploit Available: No (exploit_available: false)

The high severity of this vulnerability, combined with the ease of remote exploitation, necessitates immediate patching across all environments. IT administrators should prioritize the deployment of the provided updates to Firefox and Thunderbird to prevent potential service instability and maintain the security posture of the organization.