Description
Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
Published: 2026-09-29
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A race condition combined with a use-after-free bug in the Audio/Video component of Firefox and Thunderbird allows an attacker to free an object and then access it again during media playback. This flaw can lead to the execution of arbitrary code or to a crash of the affected application. The vulnerability is identified as a concurrency issue (CWE-362), a memory-management flaw (CWE-416), and a permission control flaw (CWE-825).

Affected Systems

Any installation of Firefox or Thunderbird older than version 157 on supported operating systems—Windows, macOS, Linux, Android, iOS, and other platforms—is impacted.

Risk and Exploitability

The flaw has a CVSS score of 7.5, indicating a high impact threat, but its EPSS score is less than 1%, implying a very low likelihood of exploitation. It is not listed in the CISA KEV catalog. The attack vector—based on the description—is inferred to involve attackers triggering the bug with specially crafted media content, either supplied locally or remotely.

Generated by OpenCVE AI on October 7, 2026 at 08:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 157 or later to receive the vendor‑supplied fix.
  • Upgrade Thunderbird to version 157 or later to receive the vendor‑supplied fix.
  • Restrict or disable automatic playback of media from untrusted sources as an interim safeguard.

Generated by OpenCVE AI on October 7, 2026 at 08:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 157. Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
References

Tue, 29 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 29 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
CWE-416
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
Description Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 157.
Title Race condition, use-after-free in the Audio/Video component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-30T17:14:58.115Z

Reserved: 2026-09-26T19:17:55.926Z

Link: CVE-2026-100805

cve-icon Vulnrichment

Updated: 2026-09-29T14:09:28.551Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T13:17:45.600

Modified: 2026-10-19T17:38:19.447

Link: CVE-2026-100805

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T12:36:21Z

Links: CVE-2026-100805 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T08:15:14Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE-416

    Use After Free

  • CWE-825

    Expired Pointer Dereference