CVE-2026-2757

Critical · CVSS 9.8

Firefox / Thunderbird WebRTC Audio/Video — Incorrect boundary conditions in WebRTC Audio/Video component

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; NVD-CWE-noinfo, CWE-1384

Description

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Search profile — drives PoC discovery

Symbols WebRTCAudio/Videomfsa2026-13mfsa2026-14mfsa2026-15mfsa2026-16bug 2001637libwebrtcWebRTC boundary check

Keywords CVE-2026-2757Firefox 148Firefox ESR 115.33Firefox ESR 140.8Thunderbird 148Thunderbird 140.8WebRTC boundary conditionsmfsa2026-13bugzilla 2001637WebRTC audio video exploitFirefox WebRTC PoC

Versions: Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, Thunderbird < 140.8

Ranked PoCs (3) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

AdityaBhatt3010/CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure needs review

recent activity

gh_search · JavaScript

★ 3
mbanyamer/CVE-2026-27574-OneUptime-RCE needs review

gh_search · Python

★ 1
mbanyamer/CVE-2026-27579-CollabPlatform-Appwrite-CORS-Misconfiguration needs review

gh_search · Python

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T00:30:14.000Z