CVE-2026-6778 describes an invalid pointer vulnerability in the Audio/Video Playback component of Mozilla Firefox. The flaw could lead to denial-of-service conditions but does not impact confidentiality or integrity. It was addressed in Firefox 150 as part of a broader set of memory safety and boundary condition fixes. The vulnerability is not known to be exploited in the wild. The Mozilla Foundation's security advisories MFSA 2026-30 and MFSA 2026-33 detail this and related vulnerabilities fixed in Firefox 150 and Thunderbird 150.

The vulnerability can cause denial-of-service (availability impact) in affected Firefox versions prior to 150. There is no evidence of confidentiality or integrity impact. No known active exploitation has been reported. The overall severity is medium based on CVSS 3.1 scoring (5.3), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited impact to availability only.

Mozilla has released an official fix for this vulnerability in Firefox 150 and Thunderbird 150. Users and administrators should update to Firefox 150 or later to remediate this issue. Since this is not a cloud service, remediation depends on applying the vendor's update. Patch status is confirmed by Mozilla advisories MFSA 2026-30 and MFSA 2026-33. No additional mitigation steps are required beyond updating to the fixed versions.