CVE-2026-6751 is a memory safety vulnerability caused by uninitialized memory usage in the Audio/Video: Web Codecs component of Mozilla Firefox. This flaw was fixed in Firefox 150 and Firefox ESR 140.10 releases. The CVSS v3.1 base score is 7.3 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts to confidentiality, integrity, and availability. Mozilla's security advisories mfsa2026-30 and mfsa2026-32 confirm the fix and provide detailed references to the underlying bug (Bug 2025883). The vulnerability is part of a broader set of memory safety bugs fixed in the same Firefox and Thunderbird versions.

Successful exploitation of this vulnerability could allow an attacker to access uninitialized memory, potentially leading to information disclosure, data integrity compromise, or denial of service. The CVSS score of 7.3 indicates a high impact with network-based exploitation possible without privileges or user interaction. However, no known exploits in the wild have been reported to date.

Official patches fixing this vulnerability are available in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should upgrade to these versions or later to remediate the issue. Since this is not a cloud service, remediation depends on applying these updates. There is no indication from the vendor advisory that additional mitigation steps are required beyond patching.