CVE-2026-8091

The error results from lack of proper boundary condition control during audio/video data processing (Playback component). Improper validation of input data ranges can lead to unexpected application behavior, such as access outside the permitted memory area. The attack is possible remotely, requires no authentication or user interaction, making it particularly dangerous.

An attacker can gain full control over the confidentiality, integrity, and availability of the system, including potentially executing arbitrary code in the context of the vulnerable application. In the worst case, system takeover or installation of malicious software is possible.

Software should be updated as soon as possible to the following versions containing the patch: Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2. Patches are available through Mozilla's automatic update mechanism and on the vendor's official websites.

Mozilla Firefox versions prior to 150, Mozilla Firefox ESR versions prior to 140.10.1 and prior to 115.35.2, Mozilla Thunderbird versions prior to 150 and prior to 140.10.1