CVE-2026-6757 is a medium severity vulnerability in Mozilla Firefox caused by an invalid pointer in the JavaScript WebAssembly component (CWE-824). This flaw could potentially lead to memory corruption issues. Mozilla fixed this vulnerability in Firefox 150 and Firefox ESR 140.10, as well as corresponding Thunderbird versions. The CVSS 3.1 base score is 6.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level. The vendor advisories mfsa2026-30 and mfsa2026-32 provide detailed information and confirm the fix.

The vulnerability could allow an attacker to cause memory corruption via an invalid pointer in the WebAssembly component, potentially impacting confidentiality, integrity, and availability of the affected software. However, no known exploits in the wild have been reported. The impact is rated moderate by Mozilla and medium severity by CVSS metrics.

This vulnerability is fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. Users and administrators should update to these or later versions to remediate the issue. No additional mitigation steps are required beyond applying the official updates.