Cyber Posture

CVE-2026-2759

Critical

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely remediation of flaws, directly addressing this boundary condition vulnerability through patching to fixed Firefox and Thunderbird versions.

prevent

Provides memory protections like ASLR and DEP to mitigate exploitation of boundary condition errors leading to arbitrary code execution in ImageLib.

prevent

Mandates validation of information inputs such as image data to prevent boundary condition violations in the Graphics: ImageLib component.

Security SummaryAI

CVE-2026-2759 involves incorrect boundary conditions in the Graphics: ImageLib component of Mozilla products. It affects Firefox versions prior to 148, Firefox ESR versions prior to 115.33 and 140.8, Thunderbird versions prior to 148, and Thunderbird versions prior to 140.8. The vulnerability is associated with CWE-1384 and has a CVSS v3.1 base score of 9.8.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low attack complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially enabling arbitrary code execution within the affected browser or mail client context.

Mozilla addressed the issue in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Further details on the patches and remediation are provided in Mozilla Security Advisories MFSA2026-13, MFSA2026-14, MFSA2026-15, and MFSA2026-16, as well as Bugzilla entry 2010933.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 115.33.0 · ≤ 148.0 · 128.0 — 140.8.0
mozilla
thunderbird
≤ 140.8.0 · ≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Remote RCE in browser/email client image library (no privileges or interaction required) directly enables drive-by website compromise and exploitation for client-side code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References