CVE-2026-0892
Published: 13 January 2026
Summary
CVE-2026-0892 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 32.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-0892 is a set of memory safety bugs (CWE-119) affecting Firefox 146 and Thunderbird 146, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). These bugs involve improper restriction of operations within memory bounds, and some demonstrated evidence of memory corruption. Mozilla presumes that, with sufficient effort, certain bugs could enable arbitrary code execution.
Remote attackers require no privileges or user interaction to exploit these vulnerabilities over the network with low complexity. Successful exploitation could result in high confidentiality, integrity, and availability impacts, potentially allowing full compromise of the affected browser or email client.
Mozilla's security advisories (MFSA 2026-01 and MFSA 2026-04) detail the fixes applied in Firefox 147 and Thunderbird 147. Security practitioners should urge users to update immediately, with additional technical details available in the referenced Bugzilla entries (bugs 1986912, 1996718, 1999633, 2001081, 2004443).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2358
Vulnerability details
Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was…
more
fixed in Firefox 147 and Thunderbird 147.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption (CWE-119) with demonstrated potential for arbitrary code execution in client applications (Firefox/Thunderbird), directly enabling remote exploitation for client-side code execution with no user interaction required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, prioritization, and correction of flaws like the memory safety bugs in CVE-2026-0892 via patching to Firefox 147 and Thunderbird 147.
Directly protects system memory from corruption vulnerabilities such as buffer overflows and improper memory operations underlying CVE-2026-0892 using techniques like address space layout randomization and data execution prevention.
Mandates receiving and implementing security advisories like Mozilla's MFSA 2026-01 and 2026-04 to prompt immediate updates addressing the memory safety bugs in CVE-2026-0892.