{"id":"CVE-2026-124952","kind":"vulnerability","aliases":["CVE-2026-124952"],"related":[],"title":"Firefox: use-after-free in Audio/Video component may let attackers run code","description":"Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.","summary":"A use-after-free bug in the Audio/Video component of Firefox ESR can corrupt memory when media is processed. The sources do not state what an attacker gets beyond that, and the description gives no detail on how it is triggered.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firefox","firefox-esr","other"],"not_affected_if":[],"how_to_check":"- Check the installed Firefox ESR version against the fixed release named in the sources (`115.45`)","fix":"- Firefox ESR: `115.45`","status":"open","published_at":"2026-11-10T14:17:29+00:00","first_seen_at":"2026-11-10T14:22:20+00:00","triaged_at":"2026-11-10T14:23:51+00:00","updated_at":"2026-11-10T14:23:51+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T14:23:51Z","model":"claude-haiku-5-5","output":{"fix":"- Firefox ESR: `115.45`","reach":"unknown","title":"Firefox: use-after-free in Audio/Video component may let attackers run code","impact":"medium","summary":"A use-after-free bug in the Audio/Video component of Firefox ESR can corrupt memory when media is processed. The sources do not state what an attacker gets beyond that, and the description gives no detail on how it is triggered.","audience":"everyone","category":"other","nicknames":[],"who_cares":["firefox","firefox-esr"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Confirm the attack vector, impact and whether the flaw is exploitable from web content, using the NVD entry and Mozilla's advisory for the 115.45 release.","how_to_check":"- Check the installed Firefox ESR version against the fixed release named in the sources (`115.45`)\n- unknown","plain_action":"Update Firefox ESR to version 115.45 or later.","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000659,"input_tokens":4462,"output_tokens":426,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124952':16A,19A '-2026':15A,18A '115.45':81C 'attack':11A,51B 'audio/video':7A,32B,72C 'beyond':53B 'bug':29B 'code':13A 'compon':8A,33B,73C 'corrupt':38B 'cve':14A,17A 'descript':57B 'detail':60B 'esr':23B,36B,80C 'firefox':1A,20B,22B,35B,79C 'firefox-esr':21B 'fix':77C 'free':5A,28B,69C 'get':52B 'give':58B 'let':10A 'may':9A 'media':41B 'memori':39B 'process':43B 'run':12A 'sourc':45B 'state':48B 'trigger':65B 'use':3A,26B,67C 'use-after-fre':2A,25B,66C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Firefox ESR to version 115.45 or later.","pkeys":[],"ptokens":[],"labels":["firefox","firefoxesr","other","unknown"],"campaign_type":null,"search_a":"'-124952':16A,19A '-2026':15A,18A 'attack':11A 'audio/video':7A 'code':13A 'compon':8A 'cve':14A,17A 'firefox':1A 'free':5A 'let':10A 'may':9A 'run':12A 'use':3A 'use-after-fre':2A","search_b":"'attack':51B 'audio/video':32B 'beyond':53B 'bug':29B 'compon':33B 'corrupt':38B 'descript':57B 'detail':60B 'esr':23B,36B 'firefox':20B,22B,35B 'firefox-esr':21B 'free':28B 'get':52B 'give':58B 'media':41B 'memori':39B 'process':43B 'sourc':45B 'state':48B 'trigger':65B 'use':26B 'use-after-fre':25B","search_c":"'115.45':81C 'audio/video':72C 'compon':73C 'esr':80C 'firefox':79C 'fix':77C 'free':69C 'use':67C 'use-after-fre':66C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T14:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124952","severity":null,"published_at":"2026-11-10T14:17:29+00:00","modified_at":"2026-11-10T14:17:29+00:00","first_seen_at":"2026-11-10T14:22:20+00:00","fetched_at":"2026-11-10T14:22:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}