CVE-2026-8968

published 2026-05-19

CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
mozilla	firefox	< Firefox 151	Firefox 151
mozilla	firefox	< 140.11.0	140.11.0
mozilla	firefox	< 151.0.0	151.0.0
mozilla	firefox	—	—
mozilla	firefox_esr	< Firefox ESR 140.11	Firefox ESR 140.11
mozilla	thunderbird	< Thunderbird 151	Thunderbird 151
mozilla	thunderbird	< Thunderbird 140.11	Thunderbird 140.11
mozilla	thunderbird	< 140.11	140.11
mozilla	thunderbird	< 151.0.0	151.0.0
rhel10	firefox-flatpak	—	—

CWE-400