CVE-2026-113400: Uninitialized memory in the Audio/Video: cubeb component
Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 158.0.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires no privileges, but does require user interaction. An attacker would need to induce a user to interact with attacker-controlled content.
Which products and versions need remediation?
Mozilla Firefox and Mozilla Thunderbird are listed as affected software. The issue was fixed in Firefox 158.0.1; no Thunderbird fixed version is provided in the available data.
What is the potential impact if exploited?
The CVSS rating is medium, with low impact to confidentiality and integrity and no stated availability impact. The vector does not indicate a scope change.