EUVD-2026-88908
GHSA-mxhc-r43m-899w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost page with crafted media
-
DeliveryLure victim to load page
-
ExploitTrigger boundary error in A/V playback
-
ExecutionCorrupt content-process memory
-
ImpactAchieve confidentiality/integrity compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to load attacker-controlled audio/video content in an unpatched Firefox (UI:R) - e.g., visiting a malicious or compromised web page or opening crafted media that reaches the Playback component. No authentication is required (PR:N) and the attack is remote (AV:N) with low complexity (AC:L), but user interaction is the primary limiting factor; exploitation is limited to Firefox builds prior to Firefox 157, ESR 153.4, ESR 140.17, and ESR 115.42. No non-default configuration is needed - media playback is a default browser capability. |
| Impact | This is a network-reachable, unauthenticated browser memory-safety flaw (CVSS 3.1 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) in Firefox's Audio/Video Playback component, but exploitation requires user interaction (UI:R) - the victim must load an attacker-controlled page or media resource. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so the current signal is 'no public exploit identified at time of analysis.' The 8.1 base score is driven by C:H/I:H, yet notably A:N - Mozilla assessed no availability/crash impact, which is somewhat atypical for a boundary-condition memory-corruption bug (CWE-119) and suggests the flaw is characterized as controllable OOB read/write enabling info-disclosure and integrity compromise rather than a mere crash; this is a point to verify against the MFSA advisory text. Real-world priority is moderate-to-high because Firefox is ubiquitous and media parsing is a classic drive-by exploitation surface, but the requirement for user interaction and the absence of any exploitation evidence (no KEV, no EPSS, no POC) place it below actively-exploited browser zero-days. Prioritize patching on the normal rapid browser cadence rather than as an emergency. |
| Exploit ScenarioDerived | An attacker hosts a web page embedding a maliciously crafted audio or video file; when a victim using an unpatched Firefox visits the page, the Playback component mishandles a boundary condition while decoding the media, corrupting content-process memory to leak or alter data (C:H/I:H). No public exploit code was identified at the time of analysis, and successful attack depends on the victim loading the malicious content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Memory-corruption flaws in Firefox's Audio/Video Playback component (CWE-119) can be triggered when a user loads attacker-controlled audio or video content, potentially leading to high-integrity and high-confidentiality compromise of the browser process. The issue affects Firefox builds prior to 157 and the ESR branches prior to 153.4, 140.17, and 115.42, is rated CVSS 3.1 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), and requires user interaction - the victim must visit a malicious page or open crafted media that reaches the playback stack. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.
RemediationAI
Vendor-released patches are available: upgrade to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42, choosing the ESR channel that matches your deployment. Detailed per-release guidance is published in Mozilla's advisories MFSA2026-97 through MFSA2026-103 (e.g. https://www.mozilla.org/security/advisories/mfsa2026-100/) and the bug is tracked at https://bugzilla.mozilla.org/show_bug.cgi?id=2047721; note that ESR 115 is a legacy branch, so organizations still on it should plan migration to ESR 140 or later once patched, since future media fixes may not be backported. There is no configuration switch that specifically neutralizes this defect. Compensating controls carry real trade-offs: disabling media playback via enterprise policy (e.g. Permissions/Media autoplay and, more aggressively, blocking the media element path with extensions or content policies) reduces exposure but breaks legitimate video and audio on internal applications; running Firefox in a sandboxed or virtualized context limits post-exploitation reach but adds operational overhead; and network-level blocking of untrusted media sources or restricting browsing to allowlisted sites lowers the attack surface at the cost of usability. Because the vector requires user interaction (UI:R, PR:N), user awareness training and phishing-resistant browsing hygiene are useful secondary measures, but patching remains the only complete fix.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Audio/Video: Playback component of Gecko, Mozilla's browser engine, which handles decoding, demuxing, and rendering of media through the browser's media pipeline (including the HTMLMediaElement/Web Audio paths and associated platform decoders). It is classified as CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer - the advisory describes incorrect boundary conditions, meaning length or index checks on a media buffer are insufficient or malformed, allowing out-of-bounds reads/writes when specially crafted media data is parsed. Because the affected code runs inside the Firefox content/renderer context, a successful trigger can corrupt memory in a way that undermines both confidentiality and integrity (C:H/I:H), while availability is not assessed as directly impacted (A:N). The CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* indicates all Firefox versions before the fixed releases are in scope. The relevant vendor advisories are MFSA2026-97 through MFSA2026-103, with the underlying report tracked in Mozilla Bugzilla bug 2047721.
Know when Mozilla gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Remote drive-by via crafted media (AV:N/AC:L/PR:N) needing the victim to load content (UI:R); memory corruption yields C:H/I:H, and vendor asserts no availability impact (A:N).
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Executive ViewAI
A memory-corruption flaw in Mozilla Firefox's audio/video playback component allows a malicious web page or crafted media file to compromise the browser process, exposing both sensitive data and the ability of an attacker to run code under the user's session. Every employee who browses the web with an unpatched Firefox build is a potential entry point, making this a broad, organization-wide exposure rather than an isolated server-side issue. Because browser compromise frequently becomes a stepping stone to credential theft, session hijacking, and lateral movement into internal systems, leadership should treat timely browser fleet remediation as a priority even though no public exploit or confirmed active exploitation has been identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Affected Products (CPE)CVE.org
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b
Exploit-DB