Is CVE-2026-8091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8091 being exploited in the wild.

How severe is CVE-2026-8091?

Critical severity, with a CVSS score of 9.8, published 7 May 2026.

Which products and versions are affected?

Mozilla Firefox < 150; Mozilla Firefox ESR < 140.10.1, < 115.35.2; Mozilla Thunderbird < 150; Mozilla Thunderbird ESR < 140.10.1.

Is there a fix for CVE-2026-8091?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8091 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8091?

Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8091: Mozilla Firefox and Thunderbird incorrect boundary conditions in Audio/Video Playback

Q: Which products and versions are affected?

Mozilla Firefox < 150; Mozilla Firefox ESR < 140.10.1, < 115.35.2; Mozilla Thunderbird < 150; Mozilla Thunderbird ESR < 140.10.1.

Q: Is there a fix for CVE-2026-8091?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-8091 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-8091?

Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8091 · Severity: critical · CVSS 9.8 · Published 2026-05-07

Mozilla Firefox and Thunderbird are popular web browsing and email applications. A critical vulnerability has been identified in the component responsible for playing audio and video content. If exploited, this could allow an attacker to compromise the application, potentially leading to unauthorized access to data or the ability to execute malicious code on the user's system. Users should update to the latest versions immediately to protect their systems.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla Thunderbird ESR. Vendors: Mozilla.

Quick answers

Is CVE-2026-8091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8091 being exploited in the wild.
How severe is CVE-2026-8091?: Critical severity, with a CVSS score of 9.8, published 7 May 2026.
Which products and versions are affected?: Mozilla Firefox < 150; Mozilla Firefox ESR < 140.10.1, < 115.35.2; Mozilla Thunderbird < 150; Mozilla Thunderbird ESR < 140.10.1.
Is there a fix for CVE-2026-8091?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8091 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8091?: Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Audio/Video: Playback component of Mozilla products due to incorrect boundary conditions (CWE-754/CWE-805). The flaw allows for potential buffer access with an incorrect length value when processing media content. An unauthenticated attacker can exploit this over the network by providing specially crafted audio or video content. While Thunderbird is less susceptible in standard email-reading mode due to disabled scripting, the risk remains in browser-like contexts. The issue has been addressed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.

Affected products

Mozilla Firefox < 150
Mozilla Thunderbird < 150
Mozilla Firefox ESR < 140.10.1, < 115.35.2
Mozilla Thunderbird ESR < 140.10.1
Red Hat Enterprise Linux 6, 7, 8, 9, 10

Timeline

2026-04-21: advisory: Mozilla Foundation Security Advisory published
2026-05-07: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.