{"id":"CVE-2026-113400","kind":"vulnerability","aliases":["CVE-2026-113400"],"related":[],"title":"Firefox and Thunderbird: uninitialized memory in cubeb audio code","description":"Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.","summary":"The cubeb audio component in Firefox and Thunderbird reads uninitialized memory. The sources do not say what an attacker can do with the leaked or misused memory beyond that.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","firefox","runtime","thunderbird"],"not_affected_if":["not-running-firefox-or-thunderbird"],"how_to_check":"- Check the installed Firefox version with `firefox --version` and the Thunderbird version with `thunderbird --version`.\n- Check the installed Firefox/Thunderbird release notes or about dialog for a version below `158.0.1`.","fix":"- Update Firefox to `158.0.1` or later.\n- Update Thunderbird to `158.0.1` or later.","status":"open","published_at":"2026-10-20T13:16:41+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:16:35+00:00","updated_at":"2026-10-25T04:16:35+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:16:35Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `158.0.1` or later.\n- Update Thunderbird to `158.0.1` or later.","reach":"unknown","title":"Firefox and Thunderbird: uninitialized memory in cubeb audio code","impact":"medium","summary":"The cubeb audio component in Firefox and Thunderbird reads uninitialized memory. The sources do not say what an attacker can do with the leaked or misused memory beyond that.","category":"runtime","nicknames":[],"who_cares":["firefox","thunderbird","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Mozilla security advisory for CVE-2026-113400 to learn the exploit conditions, whether user interaction is needed, and the real impact of the uninitialized memory read.","how_to_check":"- Check the installed Firefox version with `firefox --version` and the Thunderbird version with `thunderbird --version`.\n- Check the installed Firefox/Thunderbird release notes or about dialog for a version below `158.0.1`.","needs_analyst":true,"not_affected_if":["not-running-firefox-or-thunderbird"],"who_is_affected":"Desktop users of Firefox and Thunderbird older than 158.0.1 are affected. Servers and tooling that do not run these browsers or mail clients have no exposure from this entry. The sources do not say whether any particular platform or audio configuration is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000598,"input_tokens":3261,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113400':12A,15A '-2026':11A,14A '158.0.1':61C,64C 'attack':38B 'audio':8A,22B 'audio/video':52C 'beyond':47B 'code':9A 'compon':23B,54C 'cubeb':7A,21B,53C 'cve':10A,13A 'desktop':16B 'firefox':1A,17B,25B,60C 'fix':58C 'leak':43B 'memori':5A,30B,46B,49C 'misus':45B 'read':28B 'runtim':18B 'say':35B 'sourc':32B 'thunderbird':3A,19B,27B,63C 'uniniti':4A,29B,48C 'vulner':56C","nicknames":[],"mitigations":[],"who_affected":"Desktop users of Firefox and Thunderbird older than 158.0.1 are affected. Servers and tooling that do not run these browsers or mail clients have no exposure from this entry. The sources do not say whether any particular platform or audio configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113400","severity":null,"published_at":"2026-10-20T13:16:41+00:00","modified_at":"2026-10-20T20:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}