EUVD-2026-88935
GHSA-qw4j-2qxm-8h8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted audio/video content
-
ExploitVictim loads page in Firefox
-
ExecutionAudio/Video component reads uninitialized memory
-
ImpactCrash or minor memory disclosure
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Variable initialization checks
|
| Exploitation Conditions | Requires user interaction (UI:R): the victim must load attacker-controlled web content that exercises Firefox's Audio/Video (media playback) component on an unpatched build (before Firefox 157, ESR 153.4, ESR 140.17, or ESR 115.42). No authentication or special privileges are needed by the attacker (PR:N), and no non-default configuration is required, but exploitation depends entirely on luring the victim to render malicious media. The uninitialized-memory read is non-deterministic, limiting reliable weaponization; realistic impact is a crash or incidental minor memory exposure rather than targeted data theft. |
| Impact | This is a genuinely low-priority issue despite affecting a ubiquitous product. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L, score 4.3) describes a network-reachable but availability-only impact requiring user interaction - the victim must load attacker-controlled content in Firefox. There is a notable internal tension: CWE-457 (use of uninitialized memory) and the 'Information Disclosure' tag both point toward a confidentiality leak (memory contents disclosed), yet Mozilla scored C:N/I:N/A:L (availability, not confidentiality). This suggests the flaw more likely produces a crash/instability than a reliable memory read, or Mozilla judged any leak non-material; the discrepancy should be verified against the Mozilla advisory rather than assumed. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input. SSVC data is not provided. Across all signals - low base score, UI required, no exploitation evidence - this is a low-severity hardening fix bundled into a routine Firefox security release, not an urgent threat, even though the installed base is enormous. |
| Exploit ScenarioDerived | An attacker hosts a crafted web page or media file that exercises the Audio/Video component in a way that reads uninitialized memory. A victim running an unpatched Firefox visits the page (UI:R), triggering a crash or, potentially, a minor leak of stale memory contents. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Uninitialized memory handling in Firefox's Audio/Video (media playback) component can crash the browser or leak small amounts of stale process memory when a victim loads attacker-controlled media content on an unpatched build. The issue is reachable by unauthenticated attackers (CVSS PR:N) but requires user interaction (UI:R) to render the malicious content, and the underlying uninitialized-memory read is non-deterministic, so reliable weaponization is unlikely and the realistic outcome is a crash or incidental minor memory exposure rather than targeted data theft. No public exploit code has been identified at time of analysis, and this is a genuinely low-priority issue despite Firefox's ubiquity; vendor patches are available in Firefox 157 and in the ESR branches 153.4, 140.17, and 115.42.
RemediationAI
Vendor-released patches exist: upgrade to Firefox 157, or to the appropriate extended-support release - Firefox ESR 153.4, Firefox ESR 140.17, or Firefox ESR 115.42 - depending on which train the deployment follows, and confirm the installed build after updating. The advisory set is split by channel, so administrators managing ESR fleets should consult mfsa2026-97, mfsa2026-98, mfsa2026-99, and mfsa2026-100 for the specific branch being patched, with the engineering detail in Bugzilla bug 2069804. No vendor-documented workaround is provided for this specific bug; the general compensating controls for a media-pipeline memory-safety flaw are to disable or block automatic media playback (Firefox's autoplay and media.autoplay settings), which reduces the chance a victim's browser decodes content without a deliberate click, though the trade-off is degraded usability on media-heavy sites and incomplete protection since user-initiated playback still reaches the vulnerable code. Because exploitation requires the victim to load attacker-controlled web content, restricting browsing to trusted origins or enforcing enterprise URL/extension policy provides additional risk reduction, but these are partial mitigations and should not replace applying the patched builds. No vendor-released patch alternative beyond these versions is identified in the available data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-457 (Use of Uninitialized Variable) and lives in Mozilla Firefox's Audio/Video component, the media pipeline responsible for demuxing, decoding, and rendering audio and video content delivered by web pages. When media data is parsed and internal buffers or structures are only partially initialized, the affected code can read memory that was never written by the program, producing either a crash through an invalid value or incidental disclosure of leftover process memory. Because the defect depends on non-deterministic heap/stack contents, the expected impact is unstable and not a reliable information-disclosure primitive. The CPE entry cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* is version-wildcarded, consistent with a fix that was backported across multiple release trains: the Rapid Release channel (Firefox 157) plus the ESR 153, ESR 140, and ESR 115 branches (153.4, 140.17, and 115.42), the latter indicating that older long-support deployments are also affected. The public Bugzilla record (bug 2069804) and the four Mozilla Foundation Security Advisories (mfsa2026-97, -98, -99, and -100) correspond to those separate release trains, and EUVD tracks the same issue as EUVD-2026-88935.
Know when Firefox gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CWE-457 and the Information Disclosure tag point to a low confidentiality leak from uninitialized memory (C:L), remotely reachable but requiring the victim to load content (UI:R); vendor instead chose A:L - both yield 4.3.
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
3DescriptionCVE.org
Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Exploit-DB