---
id: "CVE-2026-113400"
kind: "vulnerability"
aliases: ["CVE-2026-113400"]
title: "Firefox and Thunderbird: uninitialized memory in cubeb audio code"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["desktop", "firefox", "runtime", "thunderbird"]
not_affected_if: ["not-running-firefox-or-thunderbird"]
published_at: "2026-10-20T13:16:41+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:16:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113400", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Firefox and Thunderbird: uninitialized memory in cubeb audio code

The cubeb audio component in Firefox and Thunderbird reads uninitialized memory. The sources do not say what an attacker can do with the leaked or misused memory beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version with `firefox --version` and the Thunderbird version with `thunderbird --version`.
- Check the installed Firefox/Thunderbird release notes or about dialog for a version below `158.0.1`.

## Fix

- Update Firefox to `158.0.1` or later.
- Update Thunderbird to `158.0.1` or later.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113400

## From the sources

Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_