SB2026051409 - Debian update for firefox-esr
Published: May 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2026-7320)
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to incorrect boundary conditions in the Audio/Video component when processing media content. A remote attacker can cause the browser to process specially crafted media content to disclose sensitive information.
2) Input validation error (CVE-ID: CVE-2026-7321)
The vulnerability allows a remote attacker to escape the sandbox.
The vulnerability exists due to incorrect boundary conditions in the WebRTC: Networking component when handling WebRTC network traffic. A remote attacker can trigger specially crafted WebRTC network interactions to escape the sandbox.
User interaction is required to visit a specially crafted website or URL.
3) Buffer overflow (CVE-ID: CVE-2026-7322)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to memory corruption when processing crafted web content. A remote attacker can trigger memory safety bugs to execute arbitrary code.
4) Buffer overflow (CVE-ID: CVE-2026-7323)
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to memory corruption when rendering web content. A remote attacker can trigger memory corruption using specially crafted web content to execute arbitrary code.
Remediation
Install update from vendor's website.