Description
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Potential Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free in the Audio/Video: Playback component. An attacker who can supply a crafted media file can trigger memory corruption that may lead to arbitrary code execution or denial of service. The flaw originates from improper deallocation of resources that are still referenced by the playback engine, violating the correct object lifetime contract.

Affected Systems

Mozilla Firefox versions before 158, and Firefox ESR versions before 153.5, are affected as the vulnerability was fixed in those releases.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity. Because no EPSS data is available and the vulnerability is not listed in KEV, the likelihood of exploitation is uncertain. It is inferred that typical use‑after‑free flaws can be exploited remotely via crafted media files; however, this assertion is based on general exploitation patterns rather than concrete evidence specific to this CVE.

Generated by OpenCVE AI on October 13, 2026 at 17:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest stable Firefox release (158 or newer).
  • For users on the ESR channel, upgrade to Firefox ESR 153.5 or newer.
  • Apply any interim workarounds provided by Mozilla in the advisories.

Generated by OpenCVE AI on October 13, 2026 at 17:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Tue, 13 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5.
Title Use-after-free in the Audio/Video: Playback component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-13T14:18:49.293Z

Reserved: 2026-10-13T00:29:44.487Z

Link: CVE-2026-109738

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:24.370

Modified: 2026-10-13T16:19:16.897

Link: CVE-2026-109738

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:30:14Z

Weaknesses