CVE-2026-12319

Denial-of-service in the Audio/Video: Playback component

Published Jun 16, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Analysis

Technical impact

A denial‑of‑service flaw affects the Audio/Video: Playback component, allowing an attacker to crash or freeze the application when processing malicious media content. The vulnerability is identified by CWE‑400 and CWE‑770 and can disrupt user experience by rendering the browser or email client unusable. The impact is confined to the affected process and does not compromise confidentiality or integrity of data.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird are affected. Versions prior to 152 contain the flaw; the issue was fixed in Firefox 152 and Thunderbird 152.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. EPSS is below 1%, so exploitation is considered unlikely at present. The vulnerability is not listed in CISA KEV. The likely attack vector is the reception or decoding of a specially crafted audio or video file, which may be delivered locally or via a web page or email attachment. No additional requirements beyond having the vulnerable software running are mentioned.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`152`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`152`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox:::::-:::*
	cpe:2.3:a:mozilla:thunderbird:::::-:::*

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[152,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox to version 152 or later.
Upgrade Mozilla Thunderbird to version 152 or later.
Enable automatic updates for Mozilla Firefox and Thunderbird to receive the fix promptly.

Generated by OpenCVE AI on June 25, 2026 at 13:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.210% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2026933
https://nvd.nist.gov/vuln/detail/CVE-2026-12319
https://www.cve.org/CVERecord?id=CVE-2026-12319
https://www.mozilla.org/security/advisories/mfsa2026-57/
https://www.mozilla.org/security/advisories/mfsa2026-57/#CVE-2026-12319
https://www.mozilla.org/security/advisories/mfsa2026-60/
https://www.mozilla.org/security/advisories/mfsa2026-60/#CVE-2026-12319

History

Jun 25, 2026 12:45 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-12319 https://www.cve.org/CVERecord?id=CVE-2026-12319 https://www.mozilla.org/security/advisories/mfsa2026-57/#CVE-2026-12319 https://www.mozilla.org/security/advisories/mfsa2026-60/#CVE-2026-12319
Metrics	threat_severity `None`	threat_severity `Low`

Jun 16, 2026 8:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::-:::* cpe:2.3:a:mozilla:thunderbird:::::-:::*
Vendors & Products		Mozilla thunderbird

Jun 16, 2026 4:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152.	Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
References		https://www.mozilla.org/security/advisories/mfsa2026-60/

Jun 16, 2026 3:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-400
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 16, 2026 3:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Vendors & Products		Mozilla Mozilla firefox

Jun 16, 2026 1:15 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 152.
Title		Denial-of-service in the Audio/Video: Playback component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2026933 https://www.mozilla.org/security/advisories/mfsa2026-57/