CVE-2026-8954

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
May 19, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-895407.8In the Linux kernel, the following vulnerability has been resolved: sunrpc: init gssp_lock before publishing proc entry create_use_gss_proCVE-2026-895419.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_unwrap_resp_priv length checks gss_unwrap_resp_privCVE-2026-895429.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: harden gss_krb5_unwrap_v2 against short tokens gss_krb5_unwrapCVE-2026-89543In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_reCVE-2026-895447.5In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssx_dec_option_array error path bugs Four coupled defectsCVE-2026-895457.8In the Linux kernel, the following vulnerability has been resolved: sunrpc: defer rq_argp and rq_resp free until after RCU grace period svCVE-2026-895469.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: close backchannel before destroying callback service A backchaCVE-2026-895478.1In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Check svc pool percpu counter allocation __svc_create() initiaCVE-2026-895487.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: always drain cache_cleaner before destroying a cache_detail suCVE-2026-895497.5In the Linux kernel, the following vulnerability has been resolved: sunrpc: route to a populated pool in svc_pool_for_cpu() svc_set_num_thCVE-2026-89558.8Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and ThCVE-2026-895509.8In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: enforce krb5 token minimum length svcauth_gss_unw
CVE-2026-8954: High severity, CVSS 7.5 | Vulnix