{"id":"CVE-2026-124865","kind":"vulnerability","aliases":["CVE-2026-124865"],"related":[],"title":"Firefox: use-after-free in Audio/Video component may allow code execution","description":"Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.","summary":"A use-after-free bug in the Audio/Video component of Firefox was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. The sources do not state what an attacker can do with it beyond the memory corruption itself.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","firefox","other"],"not_affected_if":[],"how_to_check":"- Check the installed Firefox version in Firefox's About dialog (Help > About Firefox) and compare it to the fixed versions `160`, `115.45` and `153.7`.","fix":"- Firefox: `160`\n- Firefox ESR: `115.45` and `153.7`","status":"open","published_at":"2026-11-10T14:17:18+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","triaged_at":"2026-11-10T14:26:31+00:00","updated_at":"2026-11-10T14:26:31+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T14:26:31Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox: `160`\n- Firefox ESR: `115.45` and `153.7`","reach":"unknown","title":"Firefox: use-after-free in Audio/Video component may allow code execution","impact":"high","summary":"A use-after-free bug in the Audio/Video component of Firefox was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7. The sources do not state what an attacker can do with it beyond the memory corruption itself.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","browsers"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser, exploitation not described","analyst_note":"Check Mozilla's Firefox 160 security advisory for the affected version range, attack trigger, and whether exploitation is known.","how_to_check":"- Check the installed Firefox version in Firefox's About dialog (Help > About Firefox) and compare it to the fixed versions `160`, `115.45` and `153.7`.\n- unknown for other checks; the sources do not say.","plain_action":"Update Firefox to version 160 or the latest ESR release (115.45 or 153.7) through its built-in update check.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources name Firefox 160, Firefox ESR 115.45 and Firefox ESR 153.7 as the fixed versions, but do not say which earlier versions or configurations are exposed or how the flaw is triggered.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000742,"input_tokens":4482,"output_tokens":588,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124865':15A,18A '-2026':14A,17A '115.45':40B,78C '153.7':44B,82C '160':37B,75C 'allow':10A 'attack':52B 'audio/video':7A,29B,67C 'beyond':57B 'browser':19B 'bug':26B 'code':11A 'compon':8A,30B,68C 'corrupt':60B 'cve':13A,16A 'esr':39B,43B,77C,81C 'execut':12A 'firefox':1A,20B,32B,36B,38B,42B,74C,76C,80C 'fix':34B,72C 'free':5A,25B,64C 'may':9A 'memori':59B 'sourc':46B 'state':49B 'use':3A,23B,62C 'use-after-fre':2A,22B,61C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox to version 160 or the latest ESR release (115.45 or 153.7) through its built-in update check.","pkeys":[],"ptokens":[],"labels":["browsers","firefox","other","unknown"],"campaign_type":null,"search_a":"'-124865':15A,18A '-2026':14A,17A 'allow':10A 'audio/video':7A 'code':11A 'compon':8A 'cve':13A,16A 'execut':12A 'firefox':1A 'free':5A 'may':9A 'use':3A 'use-after-fre':2A","search_b":"'115.45':40B '153.7':44B '160':37B 'attack':52B 'audio/video':29B 'beyond':57B 'browser':19B 'bug':26B 'compon':30B 'corrupt':60B 'esr':39B,43B 'firefox':20B,32B,36B,38B,42B 'fix':34B 'free':25B 'memori':59B 'sourc':46B 'state':49B 'use':23B 'use-after-fre':22B","search_c":"'115.45':78C '153.7':82C '160':75C 'audio/video':67C 'compon':68C 'esr':77C,81C 'firefox':74C,76C,80C 'fix':72C 'free':64C 'use':62C 'use-after-fre':61C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124865","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124865","severity":null,"published_at":"2026-11-10T14:17:18+00:00","modified_at":"2026-11-10T14:17:18+00:00","first_seen_at":"2026-11-10T14:22:14+00:00","fetched_at":"2026-11-10T14:22:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}