CVE-2026-92005

No known exploitation. EPSS puts it in the 29th percentile. No fix published yet.

CVSS 3.15.3Medium EPSS percentile29th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-15Updated 2026-09-17Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check the version and release channel of Firefox and Thunderbird installed on company computers.
Update standard releases to 156, or update the applicable ESR branch to 140.16 or 153.3.
If updates must wait, disable or restrict access to the Web Codecs feature where your managed configuration permits it, then schedule the update.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

In plain language

Written by AI from the record

This can let someone crash Firefox or Thunderbird before version 156, or ESR 140.16 or 153.3; affected businesses should update promptly.

A network-reachable use-after-free in the Audio/Video: Web Codecs component permits unauthenticated remote denial of service through crafted content.

If you're affected

Browser or email client crashes
Staff work interruption
Lost unsaved work
Service desk workload

What is it

This is a flaw in the part of Firefox and Thunderbird that handles certain audio and video web content. It is like an application following an old address after the room behind that address has been cleared out, causing the application to fall over instead of continuing normally.

Who is affected

This matters to you if employees use Firefox or Thunderbird on business computers. An attacker does not need an account or employee action to trigger it; it is only a risk when the Audio/Video: Web Codecs component is enabled.

How urgent is it

Attackers can use crafted network content to crash affected applications remotely, making this a RED-priority update for organizations using the affected software. There is no confirmed active exploitation, no public exploit code on record, and no CISA Known Exploited Vulnerabilities listing, but do not defer the available fix.

What to do — in detail

Confirm exposure by inventorying Firefox and Thunderbird installations, including whether each is on the standard or ESR release channel, and checking whether the Audio/Video: Web Codecs component is enabled.

Upgrade standard-release Firefox and Thunderbird to 156. Upgrade the relevant ESR branch to 140.16 or 153.3; test the update through normal software-management controls before broad deployment if your organization pins browser or mail-client extensions.

If patching is delayed, use managed configuration or product controls to disable or limit Web Codecs where feasible, and reduce access to untrusted web content on affected endpoints. Monitor application crash reports and endpoint telemetry for unusual Firefox or Thunderbird crashes associated with crafted media or web content.

CISA has not listed this CVE in KEV, so there is no CISA remediation due date.

Technical context

CVE-2026-92005 is CWE-416 (use-after-free) in Audio/Video: Web Codecs, rated CVSS 5.3 (Medium) with network attack vector, low complexity, no privileges required, no user interaction, and availability impact limited to application denial of service. Findings describe remote crashes through crafted content when Web Codecs is enabled. It is not in CISA KEV, no clear dated in-the-wild exploitation claim is reported, and no public exploit code is on record. EPSS is 0.4% (32nd percentile) with a flat trend.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS29th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 29th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 3 days, from the signal feeds we watch.

2026-09-18OpenVAS check added
2026-09-17Record updated
2026-09-16Record updatedrecord updated
2026-09-15Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Mozillaoss-project · USaka mozilla corp.
- FirefoxDesktop AppOn-premConsumer Software / browser
- ThunderbirdDesktop AppOn-premCommunications / email-server-client

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Scored 5.3 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation