CVE-2026-8091

Published: May 7, 2026Modified: Jul 22, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.

Affected (3)

Products: Mozilla: Firefox, Thunderbird

Mozilla

2 products

Firefox

Thunderbird

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 115.35.2
Mozilla Firefox	From 140.0 to 140.10.1
Mozilla Thunderbird	From 140.0 to 140.10.1

Related CWEs

CWE-754

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

CWE-805

Buffer Access with Incorrect Length Value

The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

References (24)

https://bugzilla.mozilla.org/show_bug.cgi?id=2029301

Source: security@mozilla.org

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2026-30/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026-33/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026-36/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026-39/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026-42/

Source: security@mozilla.org

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:26174