CVE-2026-2792
Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
| Vendor | mozilla |
| Product | firefox |
| Ecosystems | |
| Industries | Technology |
| Published | Feb 24, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for mozilla firefox
Be the first to know when new critical vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Mozilla / Firefox
All versions affected Mozilla / Thunderbird
All versions affected References
bugzilla.mozilla.org: https://bugzilla.mozilla.org/buglist.cgi?bug_id=2008912%2C2010050%2C2010275%2C2012331 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-13/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-15/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-16/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-17/ access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-2792 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2442318 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2792.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3984 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3976 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4260 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3361 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3517 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3338 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3515 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3492 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4432 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3491 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3980 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3495 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3979 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3494 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4022 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3493 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3983 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4152 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3978 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3496 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3981 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3497 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3982 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3339 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3516
Credits
Andrew McCreight, Maurice Dauer, Olli Pettay, Ryan Hunt