CVE-2026-100783

Analyzed Analyzed - Analysis Complete

Uninitialized Memory in Firefox Audio/Video Component

Publication date: 2026-09-29

Last updated on: 2026-10-05

Assigner: Mozilla Corporation

Description

Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-05

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100783

EUVD

EUVD-2026-88935

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	From 154.0.0 (inc) to 157.0.0 (exc)
mozilla	thunderbird	From 154.0 (inc) to 157.0 (exc)
mozilla	firefox	to 115.42.0 (exc)
mozilla	firefox	From 116.0 (inc) to 140.17.0 (exc)
mozilla	firefox	From 141.0 (inc) to 153.4.0 (exc)
mozilla	thunderbird	to 140.17.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.4.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-457	The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Attack-Flow Graph

Executive Summary

This vulnerability involves uninitialized memory in the Audio/Video component of Firefox browsers. Uninitialized memory means memory that has not been cleared or set to a default value, which could contain residual data from previous operations. This flaw could potentially allow attackers to access sensitive information or cause unexpected behavior in the affected software.

Detection Guidance

This vulnerability involves uninitialized memory in the Audio/Video component of Firefox. To detect it, check if your Firefox version is below the fixed versions (Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17). Use commands like 'firefox --version' to check the installed version.

Impact Analysis

This vulnerability could impact users by allowing unauthorized access to sensitive data, such as passwords or personal information, if exploited. It may also lead to crashes, instability, or unexpected behavior in the browser. Users running vulnerable versions of Firefox are at risk until they update to the patched versions.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The description only mentions uninitialized memory in the Audio/Video component without detailing potential data exposure or privacy implications.

Mitigation Strategies

Update Firefox to a fixed version: Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, or Firefox ESR 140.17 or later.

Hi! I’m here to help you understand CVE-2026-100783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70