Vulnerability in Mozilla Firefox

[ Description ]Official description

Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

[ Fixes ]Fixes and patches

• Security bulletin: Mozilla mfsa2026-115Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-115, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-113Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-113, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-114Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-114, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-111Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-111, cited by CERT-FR CERTFR-2026-AVI-1346
• Security bulletin: Mozilla mfsa2026-112Vendor patch or bulletin · CERT-FR · mozilla.org/en-US/security/advisories/mfsa2026-112, cited by CERT-FR CERTFR-2026-AVI-1346

[ Advisories ]Government CERT advisories

• CERT-FR21 Oct 2026CERTFR-2026-AVI-1346

  Multiple vulnerabilities in Mozilla products Translated from French

  Multiple vulnerabilities have been discovered in Mozilla products. Some of them allow an attacker to cause arbitrary code execution, a breach of data confidentiality and denial of service.

  CVE-2026-113400CVE-2026-113470CVE-2026-113868+5 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4064

  Mozilla products (Thunderbird, Firefox ESR and Firefox): Multiple vulnerabilities Translated from German

  Risk highCVE-2026-113866CVE-2026-113470CVE-2026-113399+5 more CVEs

[ References ]References

• bugzilla.mozilla.org/show_bug.cgi
• www.mozilla.org/security/advisories/mfsa2026-111
• www.mozilla.org/security/advisories/mfsa2026-114