Description
Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
Published: 2026-05-19
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw arises from an invalid pointer dereference in the Audio/Video Web Codecs component. When media data that triggers this dereference is processed, the component crashes, resulting in a temporary loss of media playback or browser instability. This defect is a denial‑of‑service weakness and is identified with CWE‑400. The primary impact is loss of availability, disrupting end‑user experience and any applications depending on uninterrupted media functionality.

Affected Systems

Mozilla Firefox versions prior to 151 and the ESR release prior to 140.11 are affected. The vulnerability is tied to the Web Codecs API within Firefox’s audio and video subsystem.

Risk and Exploitability

The CVSS score for this vulnerability is 7.5; EPSS is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is the delivery of crafted media data via a malicious web page or application that leverages the Web Codecs API. An attacker would need to force the browser to process such data to trigger the crash; no publicly available exploitation tools are known for this defect.

Generated by OpenCVE AI on May 19, 2026 at 18:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Mozilla Firefox update (≥151 or ESR 140.11).
  • If immediate patching is not possible, disable the Web Codecs feature via about:config settings or policy files to prevent the vulnerable component from executing.
  • Maintain an active patch management schedule by regularly checking Mozilla security advisories for updates related to browser media functionality.

Generated by OpenCVE AI on May 19, 2026 at 18:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4592-1 firefox-esr security update
Debian DLA Debian DLA DLA-4594-1 thunderbird security update
Debian DSA Debian DSA DSA-6283-1 firefox-esr security update
Debian DSA Debian DSA DSA-6288-1 thunderbird security update
History

Fri, 22 May 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 20 May 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla thunderbird

Tue, 19 May 2026 17:45:00 +0000

Type Values Removed Values Added
Description Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11. Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
References

Tue, 19 May 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416
CWE-476

Tue, 19 May 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 19 May 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Weaknesses CWE-416
CWE-476
Vendors & Products Mozilla
Mozilla firefox

Tue, 19 May 2026 13:45:00 +0000

Type Values Removed Values Added
Description Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.
Title Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-05-19T17:10:51.600Z

Reserved: 2026-05-19T12:30:13.364Z

Link: CVE-2026-8968

cve-icon Vulnrichment

Updated: 2026-05-19T14:24:19.884Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-19T14:16:53.277

Modified: 2026-05-20T14:56:28.700

Link: CVE-2026-8968

cve-icon Redhat

Severity : Low

Publid Date: 2026-05-19T12:30:14Z

Links: CVE-2026-8968 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-19T18:45:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption