Description
Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This integer overflow occurs in Mozilla’s Audio/Video: Playback component. It was fixed in Firefox 153 and Thunderbird 153.

Affected Systems

Mozilla Firefox and Mozilla Thunderbird versions earlier than 153 are affected. All releases before 153 contain the vulnerable implementation and have not yet received the patch that was released in product version 153.

Risk and Exploitability

The CVSS score of 9.8 reflects a very high severity, while the EPSS score of less than 1% signals a low but non‑zero probability that the vulnerability will be attacked in the wild. The issue is not listed in the CISA KEV catalog. Attackers would most likely deliver a specially crafted media file to the vulnerable playback component; no temporary workarounds are documented, so the only safe path is to apply the official fix.

Generated by OpenCVE AI on August 4, 2026 at 05:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Firefox release (153 or newer) to remove the flaw in all affected builds
  • Apply the latest Thunderbird release (153 or newer) to eliminate the integer overflow bug
  • If an upgrade cannot be performed immediately, minimize exposure by disabling external media playback or restricting the application’s ability to read untrusted media files, and isolate the affected host with network segmentation

Generated by OpenCVE AI on August 4, 2026 at 05:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 22 Jul 2026 20:00:00 +0000

Type Values Removed Values Added
Description Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153. Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
References

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 21 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-190
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Description Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153.
Title Integer overflow in the Audio/Video: Playback component
References

Subscriptions

Mozilla Firefox
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-07-22T19:19:14.444Z

Reserved: 2026-07-20T21:57:48.225Z

Link: CVE-2026-16408

cve-icon Vulnrichment

Updated: 2026-07-21T19:17:32.746Z

cve-icon NVD

Status : Modified

Published: 2026-07-21T13:17:16.220

Modified: 2026-07-22T20:16:59.847

Link: CVE-2026-16408

cve-icon Redhat

Severity : Low

Publid Date: 2026-07-21T12:38:19Z

Links: CVE-2026-16408 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T05:45:03Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound