CVE-2026-8968 - Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component

Back Back to CVE browser

HIGH

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component

Published May 19, 2026

7.5

HIGH

CVSS 3.1

EPSS 0.53%

Description

Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Affected products

Red Hat Enterprise Linux 10

firefox-0:140.11.0-1.el10_2

Fixed · RHSA-2026:21380
Red Hat Enterprise Linux 10

thunderbird-0:140.11.0-1.el10_2

Fixed · RHSA-2026:22325
Red Hat Enterprise Linux 10.0 Extended Update Support

firefox-0:140.11.0-1.el10_0

Fixed · RHSA-2026:27715
Red Hat Enterprise Linux 10.0 Extended Update Support

thunderbird-0:140.11.0-1.el10_0

Fixed · RHSA-2026:26539
Red Hat Enterprise Linux 7 Extended Lifecycle Support

firefox-0:140.11.0-1.el7_9

Fixed · RHSA-2026:26551
Red Hat Enterprise Linux 8

firefox-0:140.11.0-1.el8_10

Fixed · RHSA-2026:21382
Red Hat Enterprise Linux 8

thunderbird-0:140.11.0-1.el8_10

Fixed · RHSA-2026:22643
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

firefox-0:140.11.0-1.el8_4

Fixed · RHSA-2026:26629
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

thunderbird-0:140.11.0-1.el8_4

Fixed · RHSA-2026:26270
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

firefox-0:140.11.0-1.el8_4

Fixed · RHSA-2026:26629
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

thunderbird-0:140.11.0-1.el8_4

Fixed · RHSA-2026:26270
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

firefox-0:140.11.0-1.el8_6

Fixed · RHSA-2026:26606
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

thunderbird-0:140.11.0-1.el8_6

Fixed · RHSA-2026:26536
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

firefox-0:140.11.0-1.el8_6

Fixed · RHSA-2026:26606
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

thunderbird-0:140.11.0-1.el8_6

Fixed · RHSA-2026:26536
Red Hat Enterprise Linux 8.8 Telecommunications Update Service

firefox-0:140.11.0-1.el8_8

Fixed · RHSA-2026:26630
Red Hat Enterprise Linux 8.8 Telecommunications Update Service

thunderbird-0:140.11.0-1.el8_8

Fixed · RHSA-2026:26268
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

firefox-0:140.11.0-1.el8_8

Fixed · RHSA-2026:26630
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

thunderbird-0:140.11.0-1.el8_8

Fixed · RHSA-2026:26268
Red Hat Enterprise Linux 9

firefox-0:140.11.0-1.el9_8

Fixed · RHSA-2026:21378
Red Hat Enterprise Linux 9

thunderbird-0:140.11.0-1.el9_8

Fixed · RHSA-2026:21381
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

firefox-0:140.11.0-1.el9_2

Fixed · RHSA-2026:26491
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

thunderbird-0:140.11.0-1.el9_2

Fixed · RHSA-2026:26269
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

firefox-0:140.11.0-1.el9_4

Fixed · RHSA-2026:26493
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

thunderbird-0:140.11.0-1.el9_4

Fixed · RHSA-2026:26174
Red Hat Enterprise Linux 9.6 Extended Update Support

firefox-0:140.11.0-1.el9_6

Fixed · RHSA-2026:26492
Red Hat Enterprise Linux 9.6 Extended Update Support

thunderbird-0:140.11.0-1.el9_6

Fixed · RHSA-2026:26521
Red Hat Enterprise Linux 10

rhel10/firefox-flatpak

Affected
Red Hat Enterprise Linux 10

rhel10/thunderbird-flatpak

Affected
Red Hat Enterprise Linux 6

firefox

Out of support scope
Red Hat Enterprise Linux 6

thunderbird

Out of support scope
Red Hat Enterprise Linux 7

thunderbird

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	firefox-0:140.11.0-1.el10_2	Fixed	RHSA-2026:21380
Red Hat Enterprise Linux 10	thunderbird-0:140.11.0-1.el10_2	Fixed	RHSA-2026:22325
Red Hat Enterprise Linux 10.0 Extended Update Support	firefox-0:140.11.0-1.el10_0	Fixed	RHSA-2026:27715
Red Hat Enterprise Linux 10.0 Extended Update Support	thunderbird-0:140.11.0-1.el10_0	Fixed	RHSA-2026:26539
Red Hat Enterprise Linux 7 Extended Lifecycle Support	firefox-0:140.11.0-1.el7_9	Fixed	RHSA-2026:26551
Red Hat Enterprise Linux 8	firefox-0:140.11.0-1.el8_10	Fixed	RHSA-2026:21382
Red Hat Enterprise Linux 8	thunderbird-0:140.11.0-1.el8_10	Fixed	RHSA-2026:22643
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	firefox-0:140.11.0-1.el8_4	Fixed	RHSA-2026:26629
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	thunderbird-0:140.11.0-1.el8_4	Fixed	RHSA-2026:26270
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	firefox-0:140.11.0-1.el8_4	Fixed	RHSA-2026:26629
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	thunderbird-0:140.11.0-1.el8_4	Fixed	RHSA-2026:26270
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	firefox-0:140.11.0-1.el8_6	Fixed	RHSA-2026:26606
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	thunderbird-0:140.11.0-1.el8_6	Fixed	RHSA-2026:26536
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	firefox-0:140.11.0-1.el8_6	Fixed	RHSA-2026:26606
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	thunderbird-0:140.11.0-1.el8_6	Fixed	RHSA-2026:26536
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	firefox-0:140.11.0-1.el8_8	Fixed	RHSA-2026:26630
Red Hat Enterprise Linux 8.8 Telecommunications Update Service	thunderbird-0:140.11.0-1.el8_8	Fixed	RHSA-2026:26268
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	firefox-0:140.11.0-1.el8_8	Fixed	RHSA-2026:26630
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	thunderbird-0:140.11.0-1.el8_8	Fixed	RHSA-2026:26268
Red Hat Enterprise Linux 9	firefox-0:140.11.0-1.el9_8	Fixed	RHSA-2026:21378
Red Hat Enterprise Linux 9	thunderbird-0:140.11.0-1.el9_8	Fixed	RHSA-2026:21381
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	firefox-0:140.11.0-1.el9_2	Fixed	RHSA-2026:26491
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	thunderbird-0:140.11.0-1.el9_2	Fixed	RHSA-2026:26269
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	firefox-0:140.11.0-1.el9_4	Fixed	RHSA-2026:26493
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	thunderbird-0:140.11.0-1.el9_4	Fixed	RHSA-2026:26174
Red Hat Enterprise Linux 9.6 Extended Update Support	firefox-0:140.11.0-1.el9_6	Fixed	RHSA-2026:26492
Red Hat Enterprise Linux 9.6 Extended Update Support	thunderbird-0:140.11.0-1.el9_6	Fixed	RHSA-2026:26521
Red Hat Enterprise Linux 10	rhel10/firefox-flatpak	Affected	n/a
Red Hat Enterprise Linux 10	rhel10/thunderbird-flatpak	Affected	n/a
Red Hat Enterprise Linux 6	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 6	thunderbird	Out of support scope	n/a
Red Hat Enterprise Linux 7	thunderbird	Out of support scope	n/a

Remediation

Red Hat statement

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (12)

https://access.redhat.com/security/cve/CVE-2026-8968
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=2030467
Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2479846
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30916
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8968
https://www.cve.org/CVERecord?id=CVE-2026-8968
https://www.mozilla.org/security/advisories/mfsa2026-46/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-48/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8968
https://www.mozilla.org/security/advisories/mfsa2026-50/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-51/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8968

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-8968		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=2030467		Permissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=2479846		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30916		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-8968
https://www.cve.org/CVERecord?id=CVE-2026-8968
https://www.mozilla.org/security/advisories/mfsa2026-46/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-48/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-48/#CVE-2026-8968
https://www.mozilla.org/security/advisories/mfsa2026-50/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-51/		Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-51/#CVE-2026-8968

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mozilla

Published May 19, 2026

Updated May 19, 2026

Reserved May 19, 2026

Link CVE-2026-8968

CISA Vulnrichment

Updated May 19, 2026

NVD

Status Analyzed

Modified Jul 23, 2026

Link CVE-2026-8968

Red Hat

Severity Low

Public date May 19, 2026

Bugzilla 2479846

Link CVE-2026-8968

ENISA EUVD

Assigner mozilla

Published May 19, 2026

Updated May 19, 2026

Link EUVD-2026-30916

GitHub

No data