CVE-2026-8091

EUVD-2026-28362
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
150.0.1-1
fixed
firefox-esr
bookworm
vulnerable
bookworm (security)
140.10.1esr-1~deb12u1
fixed
bullseye
vulnerable
bullseye (security)
vulnerable
forky
140.10.1esr-1
fixed
sid
140.10.1esr-1
fixed
trixie
vulnerable
trixie (security)
140.10.1esr-1~deb13u1
fixed
thunderbird
bookworm
vulnerable
bookworm (security)
1:140.10.1esr-1~deb12u1
fixed
bullseye
vulnerable
bullseye (security)
vulnerable
forky
1:140.10.1esr-1
fixed
sid
1:140.10.1esr-1
fixed
trixie
vulnerable
trixie (security)
1:140.10.1esr-1~deb13u1
fixed
Vulnerability Media Exposure
References
https://bugzilla.mozilla.org/show_bug.cgi?id=2029301
https://www.mozilla.org/security/advisories/mfsa2026-30/
https://www.mozilla.org/security/advisories/mfsa2026-33/
https://www.mozilla.org/security/advisories/mfsa2026-36/
https://www.mozilla.org/security/advisories/mfsa2026-39/
https://www.mozilla.org/security/advisories/mfsa2026-42/