CVE-2026-124861

EUVD-2026-121053
Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mozillaCNA
9.6 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
mozillafirefox
𝑥
< 160
CNA
mozillafirefox_esr
𝑥
< 115.45
CNA
mozillafirefox_esr
116.0.0 ≤
𝑥
< 153.7
CNA
mozillathunderbird
𝑥
< 160
CNA
mozillathunderbird_esr
𝑥
< 153.7
CNA
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
vulnerable
firefox-esr
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
References
https://bugzilla.mozilla.org/show_bug.cgi?id=2074210
https://www.mozilla.org/security/advisories/mfsa2026-125/
https://www.mozilla.org/security/advisories/mfsa2026-126/
https://www.mozilla.org/security/advisories/mfsa2026-127/
https://www.mozilla.org/security/advisories/mfsa2026-128/
https://www.mozilla.org/security/advisories/mfsa2026-129/