CVE-2026-2771
Published: 24 February 2026
Summary
CVE-2026-2771 is a critical-severity Out-of-bounds Read (CWE-125) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 8.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and correction of flaws like CVE-2026-2771 through patching affected Firefox and Thunderbird versions to prevent remote exploitation.
Mandates vulnerability scanning to identify systems running vulnerable versions of Firefox and Thunderbird affected by CVE-2026-2771's out-of-bounds read.
Ensures receipt and dissemination of security advisories like Mozilla's MFSA 2026-13, enabling awareness and remediation of CVE-2026-2771.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read in browser DOM rendering engine enables remote arbitrary code execution with no privileges or user interaction, directly mapping to drive-by compromise via malicious web content and exploitation for client execution.
NVD Description
Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Deeper analysisAI
CVE-2026-2771 is a high-severity vulnerability involving undefined behavior in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It affects versions of Firefox prior to 148, Firefox ESR prior to 115.33 and 140.8, Thunderbird prior to 148, and Thunderbird prior to 140.8. The issue is associated with CWE-125 (out-of-bounds read) and carries a CVSS v3.1 base score of 9.8, indicating critical risk due to its potential for severe impact.
The vulnerability enables remote attackers to exploit affected browsers over the network with low attack complexity, requiring no privileges, no user interaction, and maintaining an unchanged scope. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution or other severe compromises within the browser's rendering engine.
Mozilla's security advisories (MFSA 2026-13 through 2026-16) and the associated Bugzilla entry detail the fix, recommending immediate upgrades to Firefox 148, Firefox ESR 115.33 or 140.8, Thunderbird 148, or Thunderbird 140.8 to mitigate the issue. No workarounds are specified in the provided references.
Details
- CWE(s)