Mozilla Firefox and Mozilla Thunderbird security vulnerabilities

Mozilla Firefox and Mozilla Thunderbird are both products of the American Mozilla Foundation. Mozilla Firefox is an open-source web browser. Mozilla Thunderbird is an email client software that emerged independently from the Mozilla Application Suite. This software supports IMAP and POP email...

PT-2026-33937

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Firefox ESR versions prior to 140.10 Thunderbird versions prior to 150 Thunderbird versions prior to 140.10 Description Uninitialized memory exists in the Audio/Video: Web Codecs component. Recommendations Update ...

PT-2026-34178

WWBN AVideo is an open source video platform. In versions 29.0 and prior, objects/configurationUpdate.json.php also routed via /updateConfig persists dozens of global site settings from $ POST but protects the endpoint only with User::isAdmin. It does not call forbidIfIsUntrustedRequest, does not...

CVE-2026-6780: Uncontrolled Resource Consumption

Denial-of-service in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

Mozilla -- Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component

https://bugzilla.mozilla.org/showbug.cgi?id=2027564 reports: Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component...

Mozilla -- Denial-of-service

https://bugzilla.mozilla.org/showbug.cgi?id=2025583 reports: Denial-of-service in the Audio/Video: Playback component...

Mozilla -- Uninitialized memory

https://bugzilla.mozilla.org/showbug.cgi?id=2022604 reports: Uninitialized memory in the Audio/Video: Web Codecs component...

Mozilla -- Invalid pointer

https://bugzilla.mozilla.org/showbug.cgi?id=2022746 reports: Invalid pointer in the Audio/Video: Playback component...

Mozilla Thunderbird < 150.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 150.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-33 advisory. - Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerabili...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011187)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011187 advisory. In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: set devicecaps for 417 The videodevice for the MPEG encoder did not set devicecap...

CVE-2026-6748: Use of Uninitialized Variable

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

CVE-2026-6783: Integer Overflow or Wraparound

Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

CVE-2026-6751: Use of Uninitialized Variable

Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

PT-2026-34216

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.1 Description An incomplete fix in the 'test.php' file allows for unsanitized input. While the wget path was secured using escapeshellarg, the file get contents and curl code paths remain unsanitized. Additionally,...

CVE-2026-6778: NULL Pointer Dereference

Invalid pointer in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

PT-2026-38429

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Thunderbird versions prior to 150 Firefox ESR versions prior to 140.10.2 Firefox ESR versions prior to 115.35.2 Description Incorrect boundary conditions exist in the Audio/Video: Playback component. Recommendatio...

PT-2026-34204

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier Description An incomplete fix in the CloneSite feature allows for the deletion of arbitrary files. The deleteDump parameter in a GET request does not properly filter path traversal sequences, such as ../.....

WWBN AVideo Access Control Vulnerability

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained an access control vulnerability. This vulnerability stemmed from incomplete CORS origin validation repairs, as two code paths still reflected arbitrary Origin...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-006888)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006888 advisory. In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has bee...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013173)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013173 advisory. In the Linux kernel, the following vulnerability has been resolved: ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy For some reason, the driver...