CVE-2026-8946

HighCVSS 7.5

Published: 19/05/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

A vulnerability in the Web Codecs component of Firefox and Thunderbird is caused by incorrect boundary conditions, potentially leading to unexpected behavior. The flaw is fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Risk Assessment

The risk involves possible system stability or security compromise through exploitation of audio/video stream processing errors, which could allow an attacker to perform unauthorized operations.

Recommendation

Immediately update Firefox and Thunderbird to the versions specified in the description (Firefox 151, Firefox ESR 115.36/140.11, Thunderbird 151/140.11) to remediate the vulnerability.

Original NVD description (English source)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.