CVE-2026-100805

Awaiting Analysis Awaiting Analysis - Queue

Race Condition and Use-After-Free in Firefox Audio/Video Component

Publication date: 2026-09-29

Last updated on: 2026-09-30

Assigner: Mozilla Corporation

Description

Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-100805

EUVD

EUVD-2026-88958

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	157

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a race condition and use-after-free vulnerability in Firefox's Audio/Video component. A race condition occurs when two or more threads access shared data simultaneously, leading to unexpected behavior. Use-after-free happens when a program continues to use memory after it has been freed, potentially causing crashes or arbitrary code execution.

Detection Guidance

This vulnerability is specific to Firefox versions before 157. Detect it by checking your Firefox version with commands like 'firefox --version' or 'about:support' in Firefox. If the version is below 157, the system is vulnerable.

Impact Analysis

This vulnerability could allow attackers to execute arbitrary code, crash the browser, or gain unauthorized access to sensitive data. Users running vulnerable versions of Firefox may be at risk of data theft, malware installation, or system compromise if the flaw is exploited.

Compliance Impact

The provided CVE data does not specify how this vulnerability affects compliance with standards like GDPR or HIPAA. Without additional context on data types processed or impacted systems, no direct compliance impact can be determined.

Mitigation Strategies

Update Firefox to version 157 or later to address the race condition and use-after-free vulnerability in the Audio/Video component.

Hi! I’m here to help you understand CVE-2026-100805. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70