What is the CVSS score of CVE-2026-8968?

CVE-2026-8968 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Mozilla Firefox are affected by CVE-2026-8968?

A remote denial-of-service vulnerability in Mozilla Firefox enables attackers to crash the browser via crafted media files, affecting all Firefox users in the organization without requiring…. A patch is available.

How to fix or mitigate CVE-2026-8968?

Within 24 hours, identify and inventory all Firefox deployments across the organization, including Firefox ESR instances on managed and unmanaged endpoints. Within 7 days, deploy Firefox version 151 or Firefox ESR version 140.11 to all systems via your patch management process, prioritizing business-critical workstations and those with public-facing roles. Within 30 days, verify 100% compliance through deployment reporting and monitor Firefox update telemetry to confirm all instances have upgraded.

Mozilla Firefox CVE-2026-8968

EUVD-2026-30916 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-19 mozilla

GHSA-g34x-mgc7-jqch

Denial Of Service Mozilla

High

Disputed · 7.5 Vendor: mozilla

Severity by source

Sources disagree (Low–High)

Vendor (mozilla) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote crafted content triggers the crash with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only DoS (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

3.4 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:40 vuln.today

CVE Published

May 19, 2026 - 12:30 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 12:30 cve.org

HIGH 7.5

DescriptionCVE.org

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.

AnalysisAI

Denial-of-service in Mozilla Firefox's Web Codecs (Audio/Video) component allows a remote attacker to crash the browser via an invalid pointer, triggered by loading crafted media content with no authentication or user interaction. The flaw is fixed in Firefox 151 and Firefox ESR 140.11; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), consistent with SSVC rating exploitation as none.

Technical ContextAI

The vulnerability lives in the WebCodecs implementation, the browser API that gives JavaScript low-level access to audio and video encoders/decoders and raw frames. An invalid pointer dereference in this native media-processing path leads to a memory-safety fault. The CWE-400 (Uncontrolled Resource Consumption) classification, combined with the availability-only CVSS impact (C:N/I:N/A:H), indicates the defect manifests as a crash/resource-exhaustion condition rather than code execution or data disclosure. Affected code is Mozilla's Gecko engine (cpe:2.3:a:mozilla:firefox), shipped in the mainline Firefox and the ESR long-term-support branch, and repackaged by downstream Linux distributors such as SUSE and Red Hat.

RemediationAI

Vendor-released patch: upgrade to Firefox 151 or Firefox ESR 140.11, which contain the fix. Linux users on SUSE should apply the distribution update SUSE-SU-2026:2039 (https://www.suse.com/support/update/SUSE-SU-2026:2039/), and Red Hat users should apply the corresponding vendor errata; consult Mozilla advisories at https://www.mozilla.org/security/advisories/mfsa2026-50/ and mfsa2026-51/ for details. If patching must be deferred, a targeted compensating control is to disable the WebCodecs API surface where policy permits (for managed fleets, restrict or lock down media/JavaScript execution on untrusted sites via enterprise policy) - note this may break legitimate video-conferencing and streaming sites that rely on WebCodecs, so it is a temporary measure only until the browser is updated.

More in Mozilla

View all

CVE-2015-4495 HIGH Act Now POC

8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

CVE-2013-1690 HIGH Act Now POC

8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2013-0753 CRITICAL Act Now POC

9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2013-1710 CRITICAL Emergency POC

10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2014-1511 CRITICAL Emergency POC

9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo

CVE-2013-0643 HIGH Act Now

8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-8968 vulnerability details – vuln.today

Back

Mozilla Firefox CVE-2026-8968

Severity by source

CVSS VectorVendor: mozilla

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mozilla

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code