Cyber Posture

CVE-2026-2774

Critical

Published: 24 February 2026

Published
24 February 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0002 7.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely patching of the integer overflow vulnerability in Firefox and Thunderbird Audio/Video components to prevent remote arbitrary code execution.

detect

Enables periodic vulnerability scanning to identify systems running vulnerable versions of Firefox or Thunderbird prior to patching.

detect

Ensures timely awareness and dissemination of Mozilla security advisories (MFSA 2026-13) detailing the CVE for prioritized remediation.

Security SummaryAI

CVE-2026-2774 is an integer overflow vulnerability (CWE-190) in the Audio/Video component of Mozilla Firefox and Thunderbird products. It affects versions of Firefox prior to 148, Firefox ESR prior to 115.33 and 140.8, and Thunderbird prior to 148 and 140.8. The vulnerability was publicly disclosed on 2026-02-24 and carries a CVSS v3.1 base score of 9.8, indicating critical severity.

A remote attacker requires no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation can result in high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution within the browser or application sandbox.

Mozilla's security advisories (MFSA 2026-13 through 2026-16) and the associated Bugzilla entry (bug 2014883) detail the fix applied in the listed versions. Security practitioners should prioritize updating affected Firefox and Thunderbird installations to the patched releases to mitigate the risk.

Details

CWE(s)

Affected Products

mozilla
firefox
≤ 115.33.0 · ≤ 148.0 · 128.0 — 140.8.0
mozilla
thunderbird
≤ 140.8.0 · ≤ 148.0

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Integer overflow RCE in browser/email client AV component enables drive-by compromise (T1189) via malicious media and direct exploitation for client execution (T1203) with no user interaction required.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

References