CVE-2026-16359

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

Vulnerability in the Audio/Video: GMP component in Firefox and Thunderbird. Incorrect boundary conditions. Fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Risk Assessment

Risk of potential remote code execution or browser crash via manipulation of audio/video streams.

Recommendation

Update Firefox to version 153 or later (or appropriate ESR version) and Thunderbird to version 153 or 140.13.

Original NVD description (English source)

Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.