CVE-2015-4506: Mozilla Firefox

Medium severity, CVSS 6.8. EPSS: 4.9% chance of exploitation in the next 30 days.

Buffer overflow in the vp9_init_context_buffers function in libvpx, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3, allows remote attackers to execute arbitrary code via a crafted VP9 file.

Affected products

• Mozilla Firefox: up to and including 40.0.3; version 38.0 only; version 38.0.1 only; version 38.0.5 only; version 38.1.0 only; version 38.1.1 only; …

Published 2015-09-24. Last modified 2026-06-17.