CVE-2026-16364

Analyzed Analyzed - Analysis Complete

Incorrect Boundary Conditions in Firefox Audio/Video Playback

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Mozilla Corporation

Description

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-10

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16364

EUVD

EUVD-2026-46195

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 153.0 (exc)
mozilla	firefox	to 153.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect boundary conditions in Firefox's Audio/Video Playback component. It was patched in Firefox version 153. The issue likely allows for memory corruption or unexpected behavior during media playback.

Detection Guidance

This vulnerability is specific to Firefox 153 and was fixed in later versions. Detection involves checking the installed Firefox version. Use commands like 'firefox --version' or check about:support in Firefox. If version is 153 or earlier, the system is vulnerable.

Impact Analysis

An attacker could exploit this to crash the browser, execute arbitrary code, or gain unauthorized access to system resources. Users running unpatched Firefox versions are at risk.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with GDPR, HIPAA, or other standards. The vulnerability involves incorrect boundary conditions in Firefox's Audio/Video playback component, which could lead to high-impact confidentiality and integrity issues (CVSS 9.1). However, without additional context on data processing or storage, its compliance implications remain unclear.

Mitigation Strategies

Update Firefox to version 153 or later to address the boundary condition issue in the Audio/Video: Playback component.

Hi! I’m here to help you understand CVE-2026-16364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70