Loading vulnerability…
Incorrect boundary conditions in Firefox and Thunderbird cubeb
CVE-2026-16350 is an incorrect-boundary-condition vulnerability in the cubeb Audio/Video component used by Mozilla Firefox and Thunderbird. The affected function, precise boundary-handling error, and exploitation mechanism are not specified. Fixes are included in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability compromises boundary handling in the cubeb Audio/Video component. Its specific consequences for confidentiality, integrity, and availability are currently unavailable; arbitrary code execution and other impacts described for the associated multi-vulnerability updates are not individually attributed to CVE-2026-16350.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Apply the relevant security update.
Patch, then assume compromise.
Upgrade to Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, or Thunderbird 140.13, as appropriate for the installed release branch, or a later security-maintained version. On Debian 13 (trixie), upgrade firefox-esr to 140.13.0esr-1~deb13u1 or later and thunderbird to 1:140.13.0esr-2~deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.