CVE-2026-3845Disclosure(mozilla / firefox)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mozilla firefox systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability was fixed in Firefox 148.0.2.

mozilla CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.mozilla.org/security/advisories/mfsa2026-19/

Other references

https://bugzilla.mozilla.org/show_bug.cgi?id=2020174

Weakness type (CWE)

CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

firefox

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 3d ago at 3 mentions (2026-03-10); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

mozilla

Products

firefox

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Disclosure

350.0%

General

233.3%

Patch

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-10	3	Disclosure2Patch1
2026-03-12	1	Disclosure1
2026-03-17	1	General1
2026-03-19	1	General1

Full discourse6 posts

xvonfers@xvonfers210d
Disclosure
(CVE-2026-3845)[2020174][MediaData]Heap-BoF/OOBW in media pipeline, in VideoData::QuantizableBuffer::AllocateRecyclableData() (missing integer-range check, reached from To8BitPerChannel()) https://hg-edge.mozilla.org/mozilla-central/rev/8afd0928a896f767259d49efd94879ab8da0d306 Reported by Crixer(@pwning_me) https://t.co/icLfO46ZT6
Post summary
The post discloses CVE-2026-3845, a heap-based buffer overflow in Mozilla’s media pipeline, and links to a repository revision that presumably contains the fix.
03027144.2K
4.9K followersView on X
crixer@pwning_me211d
Patch
https://www.mozilla.org/en-US/security/advisories/mfsa2026-19/#CVE-2026-3845 Mozilla team patched this vulnerability within a week and even assigned a CVE. That’s amazing.
Post summary
The advisory confirms that Mozilla promptly patched CVE-2026-3845 within a week of its assignment.
101747.0K
239 followersView on X
CERT-PY@CERTpy205d
General
⚠️ Vulnerabilidades en productos Mozilla ❗ CVE-2026-3847 ❗ CVE-2026-3845 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-mozilla-9/ https://t.co/P2QW4i9NeN
Post summary
The tweet lists two Mozilla CVEs and directs readers to external links for additional information, but provides no details on the vulnerability itself or any associated exploits or mitigations.
02021188
6.6K followersView on X
CVE@CVEnew203d
General
CVE-2026-3845 Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability affects Firefox < 148.0.2. https://www.cve.org/CVERecord?id=CVE-2026-3845
Post summary
A CVE-2026-3845 describes a heap buffer overflow in Firefox for Android's audio/video playback component, affecting versions less than 148.0.2, with no evidence of PoC, exploitation, or patch information.
00000197
56.8K followersView on X
CVEFind.com@CveFindCom212d
Disclosure
[CVE-2026-3845: HIGH] Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability affects Firefox < 148.0.2.#cve,CVE-2026-3845,#cybersecurity https://cvefind.com/CVE-2026-3845
Post summary
The tweet announces CVE‑2026‑3845, identifying a heap buffer overflow in Firefox for Android’s Audio/Video playback component. No PoC, exploit code, active exploitation, or patch discussion is provided.
0000041
601 followersView on X
The Hacker Wire@TheHackerWire212d
Disclosure
🟠 CVE-2026-3845 - High Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability affects Firefox &lt; 148.0.2. https://www.thehackerwire.com/vulnerability/CVE-2026-3845/ https://t.co/srdW56mUET
Post summary
A new high‑severity heap buffer overflow in Firefox for Android (versions <148.0.2) has been disclosed, but no PoC, exploit, or patch information is provided.
0000035
133 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mozilla	firefox	-	android	-

Explore more

Back to dashboard mozilla CVEs firefox vulnerabilities

What researchers are saying

CVE-2026-3845

xvonfers@xvonfersDisclosure

The post discloses CVE-2026-3845, a heap-based buffer overflow in Mozilla’s media pipeline, and links to a repository revision that presumably contains the fix.

crixer@pwning_mePatch

The advisory confirms that Mozilla promptly patched CVE-2026-3845 within a week of its assignment.

CERT-PY@CERTpyGeneral

The tweet lists two Mozilla CVEs and directs readers to external links for additional information, but provides no details on the vulnerability itself or any associated exploits or mitigations.

CVE@CVEnewGeneral

A CVE-2026-3845 describes a heap buffer overflow in Firefox for Android's audio/video playback component, affecting versions less than 148.0.2, with no evidence of PoC, exploitation, or patch information.

CVEFind.com@CveFindComDisclosure

The tweet announces CVE‑2026‑3845, identifying a heap buffer overflow in Firefox for Android’s Audio/Video playback component. No PoC, exploit code, active exploitation, or patch discussion is provided.

The Hacker Wire@TheHackerWireDisclosure

A new high‑severity heap buffer overflow in Firefox for Android (versions <148.0.2) has been disclosed, but no PoC, exploit, or patch information is provided.