CVE-2026-8091 is a memory safety vulnerability caused by incorrect boundary conditions in the Audio/Video: Playback component of Mozilla Firefox. This defect could lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause denial of service. The issue affects Firefox versions prior to 150, as well as Thunderbird and Firefox ESR versions prior to their respective patched releases. Mozilla has fixed this vulnerability in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code, cause memory corruption, or trigger denial of service conditions in affected Firefox versions. The impact is rated critical due to the potential for full compromise of the affected system's confidentiality, integrity, and availability.

Mozilla has released official patches fixing this vulnerability in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2. Users and administrators should update affected products to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official updates.