{"id":"CVE-2026-117873","kind":"vulnerability","aliases":["CVE-2026-117873"],"related":[],"title":"Firefox: boundary check flaw in audio and video playback","description":"Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Incorrect boundary conditions in Firefox's Audio/Video Playback component can be triggered, per the sources without a stated impact. The sources do not say what an attacker gets beyond the memory-safety class of the flaw.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","esr","firefox","runtime"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Run `firefox --version` and compare against `159`, `115.44` (ESR) and `153.6` (ESR)\n- Check Help > About Firefox in the browser for the installed version","fix":"- Update Firefox to `159`, or Firefox ESR to `115.44` or `153.6`","status":"open","published_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:10+00:00","updated_at":"2026-10-27T14:39:10+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:39:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159`, or Firefox ESR to `115.44` or `153.6`","reach":"internet","title":"Firefox: boundary check flaw in audio and video playback","impact":"medium","summary":"Incorrect boundary conditions in Firefox's Audio/Video Playback component can be triggered, per the sources without a stated impact. The sources do not say what an attacker gets beyond the memory-safety class of the flaw.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop-browsers","esr"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown impact from sources; memory corruption possible in media playback","analyst_note":"Check the Mozilla security advisory for the CVE to confirm impact, exploitation requirements and whether it is memory corruption, using https://nvd.nist.gov/vuln/detail/CVE-2026-117873 as the starting point.","how_to_check":"- Run `firefox --version` and compare against `159`, `115.44` (ESR) and `153.6` (ESR)\n- Check Help > About Firefox in the browser for the installed version","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox builds older than the fixed releases, including desktop installs and ESR deployments. The sources do not say whether any particular media content or configuration is required to trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000592,"input_tokens":3264,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117873':12A,15A '-2026':11A,14A '115.44':76C '153.6':80C '159':73C 'attack':48B 'audio':6A 'audio/video':28B,64C 'beyond':50B 'boundari':2A,23B,60C 'browser':18B 'check':3A 'class':55B 'compon':30B,66C 'condit':24B,61C 'cve':10A,13A 'desktop':17B 'desktop-brows':16B 'esr':19B,75C,79C 'firefox':1A,20B,26B,72C,74C,78C 'fix':70C 'flaw':4A,58B 'get':49B 'impact':40B 'incorrect':22B,59C 'memori':53B 'memory-safeti':52B 'per':34B 'playback':9A,29B,65C 'runtim':21B 'safeti':54B 'say':45B 'sourc':36B,42B 'state':39B 'trigger':33B 'video':8A 'vulner':68C 'without':37B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than the fixed releases, including desktop installs and ESR deployments. The sources do not say whether any particular media content or configuration is required to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117873","severity":null,"published_at":"2026-10-27T14:16:41+00:00","modified_at":"2026-10-27T14:16:41+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}