A critical memory corruption vulnerability exists in the GMP process of Firefox and Thunderbird, which handles encrypted media. This process is sandboxed but has different privileges than the content process. The flaw allows an attacker to perform memory corruption that could lead to sandbox escape and arbitrary code execution. The vulnerability affects Firefox versions prior to 142 and ESR versions prior to 115.27, 128.14, and 140.2, as well as Thunderbird versions prior to 142, 128.14, and 140.2. Mozilla has released fixes in Firefox 142, Thunderbird 142, and the specified ESR versions.