An invalid pointer flaw in the Web Codecs component of Mozilla Firefox and Thunderbird creates a risk of service disruption through application crashes.

This vulnerability involves an invalid pointer dereference within the Audio/Video Web Codecs component. It is remotely exploitable (AV:N) by an unauthenticated attacker without requiring user interaction (UI:N), leading to a Denial-of-Service (A:H).

Successful exploitation results in application crashes, causing productivity loss and potential downtime for users relying on these applications for critical workflows. With a CVSS score of 7.5 (High), the vulnerability is particularly concerning as it is automatable, allowing attackers to potentially disrupt services across an entire organization at scale.

Immediate Action: Update Mozilla Firefox and Mozilla Thunderbird to version 151 or later, or ensure the use of the patched 140.11 maintenance release.

Proactive Monitoring: Review system crash logs and application performance metrics for recurring instability or unexpected termination of browser processes.

Compensating Controls: Utilize endpoint security software capable of detecting and blocking malformed media content that may trigger invalid pointer dereferences.

Public Exploit Available: No (exploit_available: unknown)

Due to the automatable nature of this denial-of-service vulnerability, immediate patching is recommended to maintain system availability. Ensure that all browser and mail client installations are brought up to the latest stable release to eliminate the risk of service disruption.