This vulnerability involves incorrect boundary conditions in the Web Audio component of Mozilla Firefox, identified as CVE-2026-12292. It is classified under CWE-119 and CWE-787, indicating issues related to improper bounds checking and out-of-bounds write. The flaw was addressed and fixed in Firefox 152 and Firefox ESR 140.12, as well as corresponding Thunderbird versions. The CVSS v3.1 base score is 8.1, reflecting a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact. The vendor advisories confirm the fix and provide detailed references to the underlying bugs.

Successful exploitation of this vulnerability could allow an attacker to compromise confidentiality and integrity of the affected system by exploiting incorrect boundary conditions in the Web Audio component. There is no indication of availability impact. No known exploits in the wild have been reported at this time.

Mozilla has released official fixes for this vulnerability in Firefox 152 and Firefox ESR 140.12. Users and administrators should update affected Firefox and Thunderbird installations to these versions or later to remediate the vulnerability. Patch status is confirmed by Mozilla advisories. No additional mitigation actions are required beyond applying the official updates.