CVE-2026-84122: 
NixOS vulnerability analysis and mitigation

CVE-2026-84122 is a use-after-free vulnerability in the Audio/Video component of Mozilla Firefox, discovered and reported by security researcher Hyeonjun Ahn. It affects Firefox versions prior to 155, Firefox ESR versions prior to 140.15, and Firefox ESR versions prior to 153.2. The vulnerability was publicly disclosed and patched on September 1, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium), though Mozilla rates its impact as High (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-84, Mozilla Advisory mfsa2026-85).

The vulnerability is classified as CWE-416 (Use After Free), occurring within Firefox's Audio/Video media processing component. A use-after-free condition arises when the browser accesses memory that has already been deallocated during the handling of audio or video content, potentially allowing an attacker to control the freed memory region and redirect execution flow. Exploitation requires user interaction — typically luring a victim to visit a malicious web page containing crafted audio or video content. The underlying bug is tracked as Bugzilla bug 2059965, though the report is access-restricted (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-84).

Successful exploitation could allow a remote attacker to achieve limited confidentiality and integrity impacts within the context of the browser process, consistent with the CVSS partial technical impact assessment. In a worst-case scenario, a use-after-free in a media component could be chained with other vulnerabilities to achieve arbitrary code execution or sandbox escape, though no such chaining has been publicly documented for this specific CVE. The vulnerability does not directly impact availability (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-85).

As of the disclosure date, no public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-84122. The NVD SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable, requiring user interaction to trigger. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Mozilla Advisory mfsa2026-84).

Mozilla has released patches addressing this vulnerability in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2, all announced on September 1, 2026. Users and administrators should update to one of these fixed versions immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation (Mozilla Advisory mfsa2026-82, Mozilla Advisory mfsa2026-84, Mozilla Advisory mfsa2026-85).

Mozilla rated the vulnerability as High impact in its official security advisories, consistent with the severity assigned to use-after-free memory corruption bugs in browser media components. No notable independent researcher commentary, media coverage, or significant social media discussion specific to CVE-2026-84122 has been identified beyond standard vulnerability aggregator coverage (Mozilla Advisory mfsa2026-82).