Mozilla Firefox CVE-2026-92043

Exploitation requires user interaction per CVSS UI:R - the victim must load attacker-controlled content that causes Firefox's media decoder to parse a crafted Audio/Video stream, either by visiting a malicious or compromised page or by opening a weaponized media file. No authentication and no prior privileges are required (PR:N), and the attack is network-delivered (AV:N) with low attack complexity (AC:L) once a working trigger exists. What limits real-world exploitation: the required victim action (no silent, no-interaction vector), SSVC's 'Automatable: no' rating indicating the trigger is not currently reliable or scriptable at scale, and the absence of any public proof-of-concept, KEV entry, or EPSS signal - this is a patched-in-the-lab flaw rather than an observed campaign. Version is the other hard boundary: fully updated Firefox 156 / ESR 153.3 installations are not vulnerable, and installs that have disabled media playback entirely cannot reach the vulnerable parsing path.

The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (8.8 High): network-deliverable, low complexity, no privileges or authentication needed, but gated by required user interaction, with total confidentiality, integrity and availability impact inside the vulnerable component. That combination - easy to deliver, hard to trigger without a visit, total impact on success - is a credible browser-drive-by profile rather than a remote unauthenticated worm vector. CISA's SSVC assessment is notably more conservative than the raw score: Exploitation 'none' and Automatable 'no', meaning no observed campaign and no evidence the trigger can be reliably fired without a human. There is no EPSS value in the supplied data, no CISA KEV entry, and no referenced proof-of-concept, so the exploitation signal is quiet; the CVSS/SSVC disagreement (AC:L vs Automatable:no) should be read as 'reliable trigger development is non-trivial' rather than confirmed. Technical Impact is rated 'total', which is the one strong signal that patching should be treated as urgent for exposed clients.

An attacker hosts a web page or delivers a media file containing a specially crafted audio/video stream whose length or boundary fields are malformed. A victim browses to the page (or opens the file) in an unpatched Firefox build; the media decoder processes the stream, overflows a boundary-checked buffer, and the attacker gains code execution or privilege escalation within the browser process context. Public exploit code is not identified, and SSVC marks the flaw as non-automatable, implying the trigger currently demands manual tuning.