CVE-2026-6748 is a memory safety vulnerability caused by uninitialized memory usage within the Audio/Video: Web Codecs component of Mozilla Firefox. This flaw could potentially lead to memory corruption with high impact on confidentiality, integrity, and availability. Mozilla fixed this vulnerability in Firefox 150 and Firefox ESR 140.10, along with corresponding Thunderbird versions. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting a network attack vector with no privileges or user interaction required and severe consequences. The vendor advisories (MFSA 2026-30 and MFSA 2026-32) confirm the fix and provide detailed references to the underlying bugs.

The vulnerability allows an attacker to potentially exploit uninitialized memory in the Web Codecs component, which could lead to arbitrary code execution or other severe impacts on confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 indicates critical severity. However, no known exploits in the wild have been reported so far.

Mozilla has released official fixes for this vulnerability in Firefox 150 and Firefox ESR 140.10, as well as Thunderbird 150 and Thunderbird ESR 140.10. Users and administrators should update affected products to these versions or later to remediate the vulnerability. Patch status is confirmed by the vendor advisories. No additional mitigation steps are indicated beyond applying these updates.