Uninitialized memory in the cubeb component of Firefox’s Audio/Video subsystem can allow an attacker to read sensitive data that has not been properly cleared. The flaw does not grant execution privileges but may expose information normally protected by the browser process. The weakness resides in the handling of audio buffers, leading to potential leakage of memory contents. No known code execution or privilege escalation has been reported for this issue.

Mozilla Firefox and Thunderbird are affected. The bug was fixed in version 158.0.1. All prior releases up to and including Firefox 158.0 and Thunderbird 158.0 are vulnerable, though no detailed list is provided.

The EPSS score is not published and the vulnerability is not included in the CISA KEV catalog. The CVSS score is 5.4, indicating a medium level of severity. Based on the nature of an uninitialized memory defect in an audio component, the attack is most likely local and requires the user to trigger audio processing. Exploitation may expose private data residing in the process memory, but would not necessarily allow remote code execution. With no publicly available exploit, the risk remains theoretical until proof‑of‑concept is demonstrated.