CVE-2026-16350 is a critical memory safety vulnerability classified under CWE-119, caused by incorrect boundary conditions in the Audio/Video cubeb component of Mozilla Firefox. This vulnerability allows for potential arbitrary code execution or other severe impacts due to memory corruption. It affects Firefox versions prior to 153, Firefox ESR versions prior to 115.38 and 140.13, and corresponding Thunderbird versions. Mozilla has addressed this issue with official patches in Firefox 153 and ESR releases 115.38 and 140.13. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could result in complete compromise of the affected Firefox or Thunderbird application, including arbitrary code execution, data disclosure, and denial of service. The CVSS score of 9.8 indicates critical impact on confidentiality, integrity, and availability. No confirmed active exploitation has been reported, but the severity and nature of the bug suggest a high risk if unpatched.

This vulnerability has been fixed by Mozilla in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches. Patch status is confirmed by Mozilla advisories linked in the vendor advisory content.