CVE-2026-16359: Firefox GMP Buffer Overflow Vulnerability

CVE-2026-16359 Overview

CVE-2026-16359 is a boundary condition vulnerability in the Audio/Video: Gecko Media Plugin (GMP) component used by Mozilla Firefox and Thunderbird. The flaw is classified under [CWE-119], covering improper restriction of operations within the bounds of a memory buffer. A remote attacker can trigger the condition over the network without authentication or user interaction, leading to memory corruption impacting confidentiality and integrity. Mozilla addressed the issue in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Critical Impact
Remote, unauthenticated attackers can exploit malformed media content processed by the GMP component to corrupt memory in Firefox and Thunderbird.

Affected Products

Mozilla Firefox versions prior to 153
Mozilla Firefox ESR versions prior to 115.38 and prior to 140.13
Mozilla Thunderbird versions prior to 153 and prior to 140.13

Discovery Timeline

2026-07-21 - CVE-2026-16359 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16359

Vulnerability Analysis

The vulnerability resides in the Gecko Media Plugin (GMP) subsystem responsible for handling audio and video streams within Firefox and Thunderbird. Incorrect boundary checks allow input data to exceed intended buffer limits during media processing. The condition falls under [CWE-119], improper restriction of operations within the bounds of a memory buffer. Successful exploitation can result in memory corruption inside the media handling code path.

Mozilla published the fix across multiple advisories (MFSA-2026-68 through MFSA-2026-72), indicating the issue spans both current-release and Extended Support Release (ESR) branches. The vulnerability affects clients that render untrusted media content, including web pages loaded in Firefox and HTML email messages processed by Thunderbird.

Root Cause

The root cause is an incorrect boundary condition in GMP media parsing or decoding routines. When the component processes crafted audio or video payloads, size or offset validation fails to constrain memory operations to the allocated buffer. This produces out-of-bounds read or write behavior during codec-related processing.

Attack Vector

An attacker delivers a malicious media resource to a targeted user through a web page, embedded content, or HTML email. When Firefox or Thunderbird invokes the GMP component to decode the resource, the boundary error triggers memory corruption. No authentication or user interaction beyond loading the content is required. Refer to the Mozilla Bug Report #2045424 and the Mozilla Security Advisory MFSA-2026-68 for technical details.

Detection Methods for CVE-2026-16359

Indicators of Compromise

Unexpected crashes or restarts of firefox.exe, thunderbird.exe, or the plugin-container GMP host process following media playback.
Firefox or Thunderbird crash reports referencing GMP, WebRTC, or media decoder modules.
Outbound network connections from browser processes to unfamiliar media-hosting domains preceding a crash event.

Detection Strategies

Inventory installed Firefox and Thunderbird versions across endpoints and flag any build predating the patched releases.
Monitor endpoint telemetry for anomalous child process creation from firefox or thunderbird parents, which can indicate post-exploitation activity.
Correlate browser crash dumps with proxy or DNS logs to identify malicious media sources.

Monitoring Recommendations

Enable and centrally collect Firefox and Thunderbird crash reports for triage.
Log web proxy activity for HTML5 media MIME types (audio/*, video/*) delivered from low-reputation domains.
Alert on unpatched Mozilla product versions detected during vulnerability scans.

How to Mitigate CVE-2026-16359

Immediate Actions Required

Update Firefox to version 153 or later on all endpoints.
Update Firefox ESR to 115.38 or 140.13 depending on the deployed ESR track.
Update Thunderbird to version 153 or 140.13.
Restart browser and mail client processes after the update to ensure the patched GMP component loads.

Patch Information

Mozilla released the fix in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. Details are documented in Mozilla Security Advisory MFSA-2026-68, MFSA-2026-69, MFSA-2026-70, MFSA-2026-71, and MFSA-2026-72.

Workarounds

Disable remote content loading in Thunderbird to prevent automatic media processing from untrusted email sources.
Restrict media autoplay in Firefox using the media.autoplay.default preference until updates are applied.
Deploy enterprise policy to block installation or execution of Firefox and Thunderbird versions below the patched builds.

bash

# Verify installed Firefox version on Linux endpoints
firefox --version

# Verify installed Thunderbird version
thunderbird --version

# Example enterprise policy fragment (policies.json) to disable autoplay
# Place in the distribution/ directory of the Firefox install
{
  "policies": {
    "Preferences": {
      "media.autoplay.default": {
        "Value": 5,
        "Status": "locked"
      }
    }
  }
}