Service interruption via mismatched chroma dimensions

An out-of-bounds read in Firefox before 149, Firefox ESR before 140.9, and Thunderbird before 149 or 140.9 allows remote attackers to cause a crash. RemoteImageHolder::DeserializeImage validates shared memory with the descriptor's CbCr size but discards that size; CopyData later derives larger chroma planes from a mismatched subsampling value and CopyPlane reads beyond each allocation. A crafted YCbCr descriptor must cross from a compromised remote-decoder or utility process into the content process; published scoring reports no data disclosure or modification.