Uninitialized memory in the cubeb component of Firefox’s Audio/Video subsystem can allow an attacker to read sensitive data that has not been properly cleared. The flaw does not grant execution privileges but may expose information that is normally protected by the browser process. The weakness resides in the handling of audio buffers, leading to potential leakage of memory contents. No known code execution or privilege escalation has been reported for this issue.

Mozilla Firefox is affected. The bug was fixed in version 158.0.1. All prior releases up to and including Firefox 158.0 are vulnerable, though no detailed list is provided.

EPSS score is not published and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided, so the exact severity cannot be determined. Based on the nature of an uninitialized memory defect in an audio component, the attack is most likely local and requires the user to trigger audio processing. Exploitation may expose private data residing in the process memory, but would not necessarily allow remote code execution. With no publicly available exploit, the risk remains theoretical until a proof‑of‑concept is demonstrated.