A critical integer overflow vulnerability in Mozilla Firefox and Thunderbird could lead to unauthorized information disclosure if exploited by a remote, unauthenticated attacker.

This vulnerability involves incorrect boundary conditions and an integer overflow within the Audio/Video processing component. The flaw is remotely exploitable without user interaction or authentication (AV:N/AC:L/PR:N/UI:N).

Successful exploitation of this integer overflow may result in the unauthorized disclosure of sensitive data processed by the browser or mail client. With a CVSS score of 7.5, this high-severity vulnerability represents a significant risk to organizational confidentiality, particularly if the affected applications are used to handle proprietary or sensitive communications.

Immediate Action: Update Mozilla Firefox and Thunderbird to version 140.11, 151, or a later stable release immediately.

Proactive Monitoring: Monitor network traffic for unusual patterns associated with media file processing and review application logs for signs of anomalous crashes or memory errors.

Compensating Controls: Ensure endpoint protection software is active and restricted browser/email configurations are enforced to limit the impact of potential memory-based attacks.

Public Exploit Available: No

Given the ease of exploitation (automatable) and the high severity of the potential impact, organizations should prioritize patching these applications across all endpoints. Immediate deployment of the provided updates is essential to neutralize this risk.