CVE-2026-100756

Think of this like a faulty video player that doesn't check how big a video file is allowed to be before loading it — if someone sends you a specially crafted video or audio clip, it can overflow the player's memory and let an attacker slip in and take control. You'd just need to open or play the malicious file for it to work.

This matters to you if your employees or you use Firefox for browsing or Thunderbird for email. The risk only triggers if someone opens or plays a malicious audio/video file sent to them, such as in an email attachment or on a webpage.

There's no confirmed evidence yet of attackers exploiting this specific flaw, but it's a high-severity memory-corruption bug in extremely widely-used software, and these types of bugs are typically weaponized quickly once attackers reverse-engineer the fix. Update now rather than waiting for proof of active attacks.

Confirm exposure by checking installed Firefox/Thunderbird versions across all endpoints (Help > About, or via your endpoint management tool). Target fixed versions: Firefox 157 (release) or ESR 115.42 / 140.17 / 153.4; Thunderbird 157 or 140.17 / 153.4. There is no known breaking change associated with these releases — they are routine security updates. If immediate patching isn't possible, restrict or disable in-browser/in-client media auto-play and advise users not to open unsolicited audio/video attachments or links as a temporary mitigation. No CISA KEV due date applies since this CVE is not currently listed in KEV. Monitor Mozilla's security advisories (mfsa2026-97 through mfsa2026-103) for any updates to exploitation status, and watch for a future KEV listing or public PoC release, which would elevate urgency further.

CVSS 3.1 score 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) — network-exploitable, no privileges required, but requires user interaction; impact is high confidentiality and integrity loss with no availability impact. Weakness class is CWE-119 (improper restriction of operations within the bounds of a memory buffer) in the Audio/Video Playback component. No public exploit code is on record and no dated press/KEV confirmation of in-the-wild exploitation exists. EPSS predicts low near-term exploitation likelihood (24th percentile, flat trend), and exploit maturity is currently theoretical/PoC-absent. Press attention is rising as part of a general security roundup, not tied to confirmed exploitation.