Mozilla Firefox CVE-2026-113400

Exploitation requires the victim to use Firefox prior to 158.0.1 and to load attacker-controlled media that is processed by the cubeb audio/video backend; the CVSS UI:R confirms mandatory user interaction (e.g., visiting a malicious page or opening crafted content), so there is no silent remote trigger. No authentication is required (PR:N), but the limiting factors are the user-interaction gate, the need for the cubeb path to actually handle the malicious stream, and the low impact (only small, non-targeted memory fragments are disclosed). Updating to Firefox 158.0.1 fully removes the condition.

This is a moderate-severity information-disclosure flaw (CVSS 5.4) in Firefox's cubeb Audio/Video component (CWE-457, uninitialized memory). The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated bug that nonetheless REQUIRES user interaction (UI:R) - consistent with a browser needing the victim to visit or render malicious content. Impact is limited (low confidentiality and low integrity, no availability impact), which is why severity lands in the medium band rather than critical. No EPSS score, KEV listing, or public POC was supplied in the intelligence, so there is no public exploit identified at time of analysis; the UI:R requirement and low impact further argue against widespread opportunistic exploitation. One signal to reconcile: the input vector claims C:L and I:L, whereas uninitialized-memory reads and the 'Information Disclosure' tag point to a confidentiality-only leak - the integrity impact is not clearly substantiated by the description, so I:L should be verified with Mozilla's advisory. Net: real but routine browser hardening priority - patch via normal update cadence rather than emergency response.

An attacker hosts or injects crafted audio/video content that, when processed by the cubeb backend in a victim's Firefox session, causes uninitialized heap or stack memory to be read and potentially exposed to the page. The victim must actively load the malicious content (UI:R), and no public exploit code was identified in the provided data. Successful exploitation yields a small leak of adjacent process memory, which could aid in defeating ASLR or disclosing fragments of sensitive data.