CVE-2026-100756 — Firefox ESR — Fixed in 153.4 (+ other fixes)
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
Fixed versions
Choose the version for your installed product and release branch.
| Product | Fixed versions |
|---|---|
| Firefox ESR | 153.4 / 115.42 / 140.17 |
| Thunderbird | 157 / 140.17 / 153.4 |
| Firefox | 157 |
CVSS score8.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NWeakness type (CWE)CWE-119
Vendorsmozilla
Affected products
| Vendors | Product | Versions |
|---|---|---|
| mozilla | firefox | < 115.42.0 |
| mozilla | thunderbird | < 140.17.0 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.