CVE-2026-84122: Vulnerability in Mozilla Firefox

CVE-2026-84122 is a use-after-free vulnerability (CWE-416) affecting the Audio/Video component in Mozilla Firefox and Thunderbird. This type of vulnerability involves accessing memory after it has been freed, which can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service. Mozilla fixed this vulnerability in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. The vulnerability was internally found and reported by security researchers. The CVSS v3.1 base score is 5.4 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity with no impact on availability. There are no known exploits in the wild. The vendor advisories confirm the fix and recommend updating to the specified versions.

Successful exploitation of this use-after-free vulnerability could lead to limited confidentiality and integrity impacts due to memory corruption in the Audio/Video component. The CVSS score of 5.4 reflects a medium severity, indicating that while exploitation is possible remotely without privileges, user interaction is required and the impact is limited to partial loss of confidentiality and integrity. There are no reports of active exploitation in the wild.

Mozilla has fixed this vulnerability in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. Users and administrators should update to these versions or later to mitigate this vulnerability. No additional mitigation steps are required beyond applying the official updates.