Cyber Posture

CVE-2026-6783

Medium

Published: 21 April 2026

Published
21 April 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0004 11.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Description

Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

Security SummaryAI

CVE-2026-6783 is an integer overflow vulnerability stemming from incorrect boundary conditions (CWE-190) in the Audio/Video Playback component of Mozilla Firefox and Thunderbird. The issue allows improper handling of data during media playback processing, which was addressed in Firefox version 150 and Thunderbird version 150.

The vulnerability carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating it is exploitable over the network with low complexity, requiring no privileges, no user interaction, and no change in scope. Remote unauthenticated attackers can trigger the integer overflow by supplying malicious media content, potentially leading to limited integrity impacts such as unexpected data modification without affecting confidentiality or availability.

Mozilla's security advisories (MFSA 2026-30 and MFSA 2026-33) and the associated Bugzilla entry (bug 2027564) detail the patch deployment in Firefox 150 and Thunderbird 150, recommending immediate updates to affected versions as the primary mitigation. No workarounds are specified in the provided references.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 150.0
mozilla
thunderbird
≤ 150.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Integer overflow in browser media component enables remote exploitation via malicious content (web/email) for client execution or drive-by compromise, though limited to low-integrity impact per description.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

References