CVE-2026-2792
Published: 24 February 2026
Summary
CVE-2026-2792 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 23.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-2792 involves multiple memory safety bugs, classified under CWE-787 (Out-of-bounds Write), present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. These bugs exhibited evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.
Attackers can exploit this vulnerability remotely over the network (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). Any unauthenticated remote attacker could target affected browsers or email clients to corrupt memory and, with advanced techniques, execute arbitrary code within the victim's context.
Mozilla's security advisories (MFSA 2026-13, 15, 16, and 17) detail the fixes applied in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users should update to these patched versions to mitigate the risks, as referenced in the associated Bugzilla entries.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8444
Vulnerability details
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…
more
run arbitrary code. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption RCE in client apps (Firefox/Thunderbird) with no user interaction directly enables T1203 Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of flaws like the memory safety bugs in CVE-2026-2792 by applying patches released in updated Firefox and Thunderbird versions.
Provides memory protections such as address space layout randomization and data execution prevention to block exploitation of memory corruption from out-of-bounds writes in affected browsers.
Enforces process isolation and sandboxing in browsers to limit the impact of arbitrary code execution resulting from memory safety vulnerabilities like CVE-2026-2792.