CVE-2026-8091
Critical · CVSS 9.8Mozilla Firefox / Thunderbird — Incorrect boundary conditions (CWE-754, CWE-805) in Audio/Video Playback component
- CVSS
- 9.8
- nvd
- EPSS
- 0.47%
- 38th pct
- KEV
- No
- Class
- other
- NVD-CWE-noinfo, CWE-754, CWE-805
Description
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.
Search profile — drives PoC discovery
Symbols Audio/Video Playbackmfsa2026-30mfsa2026-33mfsa2026-36mfsa2026-39bug 2029301
Keywords CVE-2026-8091Firefox 150Thunderbird 150Firefox ESR 140.10.1Firefox ESR 115.35.2audio video playback boundary conditionincorrect boundary check media playback MozillaCWE-805 buffer size validation Firefoxmfsa2026-30bugzilla 2029301
Versions: Firefox < 150, Thunderbird < 150, Firefox ESR < 140.10.1, Thunderbird ESR < 140.10.1, Firefox ESR < 115.35.2
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2029301
- https://www.mozilla.org/security/advisories/mfsa2026-30/
- https://www.mozilla.org/security/advisories/mfsa2026-33/
- https://www.mozilla.org/security/advisories/mfsa2026-36/
- https://www.mozilla.org/security/advisories/mfsa2026-39/
- https://www.mozilla.org/security/advisories/mfsa2026-42/
- https://access.redhat.com/errata/RHSA-2026:19153
- https://access.redhat.com/errata/RHSA-2026:19157
- https://access.redhat.com/errata/RHSA-2026:19348
- https://access.redhat.com/errata/RHSA-2026:19370
- https://access.redhat.com/errata/RHSA-2026:19588
- https://access.redhat.com/errata/RHSA-2026:20586
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T18:30:14.000Z