Cyber Resilience

CVE-2026-6783

Medium

Published: 21 April 2026

Published
21 April 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0023 13.7th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-6783 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Mozilla Firefox. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 13.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-6783 is an integer overflow vulnerability stemming from incorrect boundary conditions (CWE-190) in the Audio/Video Playback component of Mozilla Firefox and Thunderbird. The issue allows improper handling of data during media playback processing, which was addressed in Firefox version 150 and Thunderbird version 150.

The vulnerability carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), indicating it is exploitable over the network with low complexity, requiring no privileges, no user interaction, and no change in scope. Remote unauthenticated attackers can trigger the integer overflow by supplying malicious media content, potentially leading to limited integrity impacts such as unexpected data modification without affecting confidentiality or availability.

Mozilla's security advisories (MFSA 2026-30 and MFSA 2026-33) and the associated Bugzilla entry (bug 2027564) detail the patch deployment in Firefox 150 and Thunderbird 150, recommending immediate updates to affected versions as the primary mitigation. No workarounds are specified in the provided references.

EU & UK References

Vulnerability details

Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150 and Thunderbird 150.

CWE(s)
CWE-190

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Integer overflow in browser media component enables remote exploitation via malicious content (web/email) for client execution or drive-by compromise, though limited to low-integrity impact per description.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-2774Same product: Mozilla Firefox
CVE-2026-2762Same product: Mozilla Firefox
CVE-2026-2781Same product: Mozilla Firefox
CVE-2026-8956Same product: Mozilla Firefox
CVE-2026-0880Same product: Mozilla Firefox
CVE-2026-8949Same product: Mozilla Firefox
CVE-2026-2790Same product: Mozilla Firefox
CVE-2025-1011Same product: Mozilla Firefox
CVE-2026-6751Same product: Mozilla Firefox
CVE-2026-2795Same product: Mozilla Firefox

Affected Assets

mozilla
firefox
≤ 150.0
mozilla
thunderbird
≤ 150.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires timely installation of the vendor patch that eliminates the integer overflow in Firefox/Thunderbird 150.

SI-10 Information Input Validation good match
prevent

Enforces input validation and boundary checking that would have prevented the incorrect boundary conditions leading to the overflow.

SI-7 Software, Firmware, and Information Integrity partial match
detect

Requires integrity verification mechanisms that can detect unauthorized code or data changes resulting from exploitation of the flaw.

References