CVE-2026-6748 involves uninitialized memory usage in the Audio/Video: Web Codecs component of Mozilla Firefox. This memory safety bug could potentially be exploited to cause memory corruption, leading to high impact on confidentiality, integrity, and availability. The vulnerability was reported by Inseo An and tracked under Mozilla bug 2022604. Mozilla fixed this issue in Firefox 150 and Firefox ESR 140.10, as documented in their security advisories MFSA 2026-30 and MFSA 2026-32. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code or cause a denial of service due to memory corruption stemming from uninitialized memory in the Web Codecs component. The CVSS score of 9.8 reflects a critical impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, patching the client software is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by Mozilla advisories.