CVEFinder.io

CVE-2026-8946

⚠️ high
🔍 Scan for this CVE
Summary

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

CVSS Score
7.5
High
EPSS Score
0.6
Exploit Probability
Published Date
2026-05-19
First Seen: 2026-05-20
📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 68.9% of all 333,415 vulnerabilities in our database.

#103,718
Above average severity
Severity Percentile
🎯 CISA SSVC Assessment Updated: May 19, 2026
🔍 Exploitation Status
None
No known exploits
⚙️ Automatable
YES
Can be exploited automatically
💥 Technical Impact
Partial
Limited system impact
🏆 Discovered By
zx
SSVC data provided by CISA
Last Modified 2026-06-30
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE IDs (Weakness Types)
CWE-119 CWE-787

📦 Affected Products 4

Vendor Product Status Affected Versions
mozilla firefox Affected
< 115.36.0
mozilla firefox Affected
> 140.0 < 140.11.0
mozilla firefox Affected
< 151.0.0
mozilla thunderbird Affected
< 140.11

🔗 References 30

https://bugzilla.mozilla.org/show_bug.cgi?id=2029070
Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026...
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:21378
https://access.redhat.com/errata/RHSA-2026:21380
https://access.redhat.com/errata/RHSA-2026:21381
https://access.redhat.com/errata/RHSA-2026:21382
https://access.redhat.com/errata/RHSA-2026:22325
https://access.redhat.com/errata/RHSA-2026:22643
https://access.redhat.com/errata/RHSA-2026:26174
https://access.redhat.com/errata/RHSA-2026:26268
https://access.redhat.com/errata/RHSA-2026:26269
https://access.redhat.com/errata/RHSA-2026:26270
https://access.redhat.com/errata/RHSA-2026:26491
https://access.redhat.com/errata/RHSA-2026:26492
https://access.redhat.com/errata/RHSA-2026:26493
https://access.redhat.com/errata/RHSA-2026:26521
https://access.redhat.com/errata/RHSA-2026:26536
https://access.redhat.com/errata/RHSA-2026:26539
https://access.redhat.com/errata/RHSA-2026:26551
https://access.redhat.com/errata/RHSA-2026:26606
https://access.redhat.com/errata/RHSA-2026:26629
https://access.redhat.com/errata/RHSA-2026:26630
https://access.redhat.com/errata/RHSA-2026:27715
https://access.redhat.com/security/cve/CVE-2026-8946
https://bugzilla.redhat.com/show_bug.cgi?id=2479849
https://security.access.redhat.com/data/csaf/v2/vex/...

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-13356 🔶 medium 6.3 0.1 A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the brows... 2026-07-07
CVE-2026-57962 🔶 medium 5.3 0.2 A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitr... 2026-07-01
CVE-2026-57963 🔶 medium 6.5 0.2 An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, an... 2026-07-01
CVE-2026-14241 ⛔ critical 9.8 0.2 Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume th... 2026-06-30
CVE-2026-12289 ⚠️ high 8.8 0.4 Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.... 2026-06-16
CVE-2026-12290 ⚠️ high 8.1 0.4 Memory safety bug fixed in Firefox 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115... 2026-06-16
These CVEs affect the same products