CVE-2026-7320
published 2026-04-28CVE-2026-7320: Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.32%
24.4th percentile
Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 150.0.1 | Firefox 150.0.1 |
| mozilla | firefox | < 115.35.1 | 115.35.1 |
| mozilla | firefox | < 150.0.1 | 150.0.1 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 128.0 < 140.10.1 | 140.10.1 |
| mozilla | firefox_esr | < Firefox ESR 115.35.1 | Firefox ESR 115.35.1 |
| mozilla | firefox_esr | < Firefox ESR 140.10.1 | Firefox ESR 140.10.1 |
| mozilla | thunderbird | < Thunderbird 150.0.1 | Thunderbird 150.0.1 |
| mozilla | thunderbird | < Thunderbird 140.10.1 | Thunderbird 140.10.1 |
| mozilla | thunderbird | < 140.10.1 | 140.10.1 |
| mozilla | thunderbird | < 150.0.1 | 150.0.1 |
| mozilla | thunderbird | — | — |
| rhel10 | firefox-flatpak | — | — |
| rhel10 | thunderbird-flatpak | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component
vendor_redhat·2026-04-28·CVSS 7.5
CVE-2026-7320 [HIGH] CWE-125 firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component
firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Information disclosure due to incorrect boundary conditions in the Audio/Video component
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Affected
Package: rhel10/firefox-flatpak (Red Hat Enterprise Linux 10) - Affected
Package: rhel10/thunderbird-flatpak (Red Hat Enterprise Linux 10) - Affected
Package: thunderbird (Red Hat Enterprise Linux 10) - Affected
Package: firefox (Red Hat Enterprise Linux 6) - Out of support scope
Package
Mozilla
Mozilla Foundation Security Advisory 2026-38: CVE-2026-7320
vendor_mozilla·CVSS 7.5
CVE-2026-7320 [HIGH] Mozilla Foundation Security Advisory 2026-38: CVE-2026-7320
Mozilla Foundation Security Advisory 2026-38
CVE: CVE-2026-7320
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 150.0.1
Mozilla
Mozilla Foundation Security Advisory 2026-37: CVE-2026-7320
vendor_mozilla
CVE-2026-7320 Mozilla Foundation Security Advisory 2026-37: CVE-2026-7320
Mozilla Foundation Security Advisory 2026-37
CVE: CVE-2026-7320
Product: Firefox ESR
Impact: critical
Fixed in: Firefox ESR 115.35.1
Mozilla
Mozilla Foundation Security Advisory 2026-35: CVE-2026-7320
vendor_mozilla
CVE-2026-7320 Mozilla Foundation Security Advisory 2026-35: CVE-2026-7320
Mozilla Foundation Security Advisory 2026-35
CVE: CVE-2026-7320
Product: Firefox
Impact: high
Fixed in: Firefox 150.0.1
Mozilla
Mozilla Foundation Security Advisory 2026-36: CVE-2026-7320
vendor_mozilla
CVE-2026-7320 Mozilla Foundation Security Advisory 2026-36: CVE-2026-7320
Mozilla Foundation Security Advisory 2026-36
CVE: CVE-2026-7320
Product: Firefox ESR
Impact: high
Fixed in: Firefox ESR 140.10.1
Mozilla
Mozilla Foundation Security Advisory 2026-39: CVE-2026-7320
vendor_mozilla·CVSS 7.5
CVE-2026-7320 [HIGH] Mozilla Foundation Security Advisory 2026-39: CVE-2026-7320
Mozilla Foundation Security Advisory 2026-39
CVE: CVE-2026-7320
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 140.10.1
VulDB
Mozilla Firefox up to 150.0.0 Video information disclosure
vuldb·2026-04-28·CVSS 7.5
CVE-2026-7320 [HIGH] Mozilla Firefox up to 150.0.0 Video information disclosure
A vulnerability described as problematic has been identified in Mozilla Firefox up to 150.0.0. Impacted is an unknown function of the component Video. Executing a manipulation can lead to information disclosure.
This vulnerability is registered as CVE-2026-7320. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
GHSA
GHSA-fpr3-wjv4-wj6q: Information disclosure due to incorrect boundary conditions in the Audio/Video component
ghsa_unreviewed·2026-04-28
CVE-2026-7320 [HIGH] CWE-119 GHSA-fpr3-wjv4-wj6q: Information disclosure due to incorrect boundary conditions in the Audio/Video component
Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1.
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=2027433https://www.mozilla.org/security/advisories/mfsa2026-35/https://www.mozilla.org/security/advisories/mfsa2026-36/https://www.mozilla.org/security/advisories/mfsa2026-37/https://www.mozilla.org/security/advisories/mfsa2026-38/https://www.mozilla.org/security/advisories/mfsa2026-39/https://access.redhat.com/errata/RHSA-2026:19153https://access.redhat.com/errata/RHSA-2026:19157https://access.redhat.com/errata/RHSA-2026:19348https://access.redhat.com/errata/RHSA-2026:19370https://access.redhat.com/errata/RHSA-2026:19588https://access.redhat.com/errata/RHSA-2026:20586https://access.redhat.com/errata/RHSA-2026:21743https://access.redhat.com/errata/RHSA-2026:22324https://access.redhat.com/errata/RHSA-2026:22408https://access.redhat.com/errata/RHSA-2026:22409https://access.redhat.com/errata/RHSA-2026:22410https://access.redhat.com/errata/RHSA-2026:22708https://access.redhat.com/errata/RHSA-2026:22712https://access.redhat.com/errata/RHSA-2026:22847https://access.redhat.com/errata/RHSA-2026:24345https://access.redhat.com/errata/RHSA-2026:24717https://access.redhat.com/errata/RHSA-2026:24718https://access.redhat.com/errata/RHSA-2026:24719https://access.redhat.com/errata/RHSA-2026:24721https://access.redhat.com/errata/RHSA-2026:24844https://access.redhat.com/errata/RHSA-2026:24846https://access.redhat.com/errata/RHSA-2026:25014https://access.redhat.com/security/cve/CVE-2026-7320https://bugzilla.redhat.com/show_bug.cgi?id=2463483https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7320.json
2026-04-28
Published