PatchGap
Firefox · DOM

CVE-2026-6784

Memory Corruption in DOM
High firefox Memory Corruption 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionMemory safety bugs present in Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
ComponentDOM
Bug ClassMemory Corruption
Tracker1536243
Fix commitee4105f0e4ff (firefox) +18/-1
CISA KEVNot listed
CreditedBen Visness, Brian Grinstead, Christian Holler, Dimi Lee, Jens Stutte, Jim Mathies, John Schanck, Jon Coppeard, Karl Tomlinson, Maurice Dauer, Nika Layzell, Randell Jesup, Tom Schuster and the Mozilla Fuzzing Team
Disclosed2026-04-21

Changed Functions

FunctionChangeNotes
if
dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp
 modified

Files Changed

  • dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp
  • dom/media/platforms/ffmpeg/FFmpegLibWrapper.cpp
  • dom/media/platforms/ffmpeg/FFmpegLibWrapper.h
  • dom/media/test/crashtests/1536243.html
  • dom/media/test/crashtests/1536243.mp4
  • dom/media/test/crashtests/crashtests.list

Patch

view commit
diff --git a/dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp b/dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp
index 6bac5b77190..e628e7f7ae9 100644
--- a/dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp
+++ b/dom/media/platforms/ffmpeg/FFmpegDataDecoder.cpp
@@ -79,7 +79,7 @@ MediaResult FFmpegDataDecoder<LIBAV_VER>::AllocateExtraData() {
         FF_INPUT_BUFFER_PADDING_SIZE;
 #endif
     mCodecContext->extradata = static_cast<uint8_t*>(
-        mLib->av_malloc(mExtraData->Length() + padding_size));
+        mLib->av_mallocz(mExtraData->Length() + padding_size));
     if (!mCodecContext->extradata) {
       return MediaResult(NS_ERROR_OUT_OF_MEMORY,
                          RESULT_DETAIL("Couldn't init ffmpeg extradata"));
diff --git a/dom/media/platforms/ffmpeg/FFmpegLibWrapper.cpp b/dom/media/platforms/ffmpeg/FFmpegLibWrapper.cpp
index 3354fab3888..1f2ffb491ec 100644
--- a/dom/media/platforms/ffmpeg/FFmpegLibWrapper.cpp
+++ b/dom/media/platforms/ffmpeg/FFmpegLibWrapper.cpp
@@ -216,6 +216,7 @@ FFmpegLibWrapper::LinkResult FFmpegLibWrapper::Link() {
   AV_FUNC(av_log_set_callback, AV_FUNC_AVUTIL_ALL)
   AV_FUNC(av_log_set_level, AV_FUNC_AVUTIL_ALL)
   AV_FUNC(av_malloc, AV_FUNC_AVUTIL_ALL)
+  AV_FUNC(av_mallocz, AV_FUNC_AVUTIL_ALL)
   AV_FUNC(av_freep, AV_FUNC_AVUTIL_ALL)
   AV_FUNC(av_frame_alloc,
           (AV_FUNC_AVUTIL_55 | AV_FUNC_AVUTIL_56 | AV_FUNC_AVUTIL_57 |
diff --git a/dom/media/platforms/ffmpeg/FFmpegLibWrapper.h b/dom/media/platforms/ffmpeg/FFmpegLibWrapper.h
index aabc57d027f..448cb8d0064 100644
--- a/dom/media/platforms/ffmpeg/FFmpegLibWrapper.h
+++ b/dom/media/platforms/ffmpeg/FFmpegLibWrapper.h
@@ -132,6 +132,7 @@ struct MOZ_ONLY_USED_TO_AVOID_STATIC_CONSTRUCTORS FFmpegLibWrapper {
                                                va_list));
   void (*av_log_set_level)(int level);
   void* (*av_malloc)(size_t size);
+  void* (*av_mallocz)(size_t size);
   void (*av_freep)(void* ptr);
   int (*av_image_check_size)(unsigned int w, unsigned int h, int log_offset,
                              void* log_ctx);
diff --git a/dom/media/test/crashtests/1536243.html b/dom/media/test/crashtests/1536243.html
new file mode 100644
index 00000000000..97f3d0511b8
--- /dev/null
+++ b/dom/media/test/crashtests/1536243.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<video id='v'>
+  <source src='1536243.mp4'>
+</video>
+<script>
+  function done() {
+    document.documentElement.removeAttribute("class");
+  }
+  v.addEventListener('error', done, true);
+  v.addEventListener('ended', done, true);
+  v.play();
+</script>
diff --git a/dom/media/test/crashtests/1536243.mp4 b/dom/media/test/crashtests/1536243.mp4
new file mode 100644
index 00000000000..02411144792
Binary files /dev/null and b/dom/media/test/crashtests/1536243.mp4 differ
diff --git a/dom/media/test/crashtests/crashtests.list b/dom/media/test/crashtests/crashtests.list
index 2e386d86e72..aaa85240cae 100644
--- a/dom/media/test/crashtests/crashtests.list
+++ b/dom/media/test/crashtests/crashtests.list
@@ -209,3 +209,6 @@ skip-if(Android) load 2016497.html
 load 2017511.html
 HTTP load 2014878.html
 load 2014896.html
+skip-if(!winWidget) pref(media.hevc.enabled,true) load 1859400.html
+load 1603271.html
+load 1536243.html
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/dom/media/test/crashtests/1536243.html b/dom/media/test/crashtests/1536243.html
new file mode 100644
index 00000000000..97f3d0511b8
--- /dev/null
+++ b/dom/media/test/crashtests/1536243.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<video id='v'>
+  <source src='1536243.mp4'>
+</video>
+<script>
+  function done() {
+    document.documentElement.removeAttribute("class");
+  }
+  v.addEventListener('error', done, true);
+  v.addEventListener('ended', done, true);
+  v.play();
+</script>
diff --git a/dom/media/test/crashtests/1536243.mp4 b/dom/media/test/crashtests/1536243.mp4
new file mode 100644
index 00000000000..02411144792
Binary files /dev/null and b/dom/media/test/crashtests/1536243.mp4 differ
diff --git a/dom/media/test/crashtests/crashtests.list b/dom/media/test/crashtests/crashtests.list
index 2e386d86e72..aaa85240cae 100644
--- a/dom/media/test/crashtests/crashtests.list
+++ b/dom/media/test/crashtests/crashtests.list
@@ -209,3 +209,6 @@ skip-if(Android) load 2016497.html
 load 2017511.html
 HTTP load 2014878.html
 load 2014896.html
+skip-if(!winWidget) pref(media.hevc.enabled,true) load 1859400.html
+load 1603271.html
+load 1536243.html
Loading diff…
On This Page