Executive brief
A vulnerability exists in the WebRTC component of Firefox and Thunderbird, which is used for real-time audio and video communication. An attacker could exploit this flaw by sending specially crafted video data during a call or session. This could lead to the theft of sensitive information, unauthorized access to the user's system, or causing the application to crash.
Technical details
An out-of-bounds (OOB) write and read vulnerability exists in the 'WebrtcGmpVideoDecoder::Decode_g' function within the WebRTC component. The root cause is incorrect boundary conditions where the decoder fails to properly validate the size of EncodedImage buffers. Specifically, while zero-length frames are rejected, buffers of 1–3 bytes are allowed to proceed. The code then attempts to write a 4-byte header and perform a memory copy based on an underflowed size calculation (size - 4). A remote attacker can exploit this by delivering malicious H.264 frames over a WebRTC connection, potentially achieving remote code execution or information disclosure within the GMP process. The issue is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, and Thunderbird 148/140.8.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla Thunderbird < 148, < 140.8
- Red Hat Enterprise Linux Server (v. 7 ELS) affected
Timeline
- 2026-02-24: advisory: Mozilla Foundation Security Advisory published
- 2026-02-24: patched: Fixed in Firefox 148 and ESR versions
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2001637
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338