PatchSiren cyber security CVE debrief

CVE-2026-2447 Mozilla CVE debrief

CVE-2026-2447 is a high-severity vulnerability in libvpx, a library used in Mozilla products. The vulnerability is a heap buffer overflow, which can be exploited by attackers to execute arbitrary code. It was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. Users of these products should update to the latest versions to mitigate the vulnerability. The CVE was published on February 16, 2026, and last modified on June 30, 2026.

Vendor: Mozilla
Product: Firefox
CVSS: HIGH 8.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-02-16
Original CVE updated: 2026-07-15
Advisory published: 2026-02-16
Advisory updated: 2026-07-15

Who should care

Users of Mozilla Firefox, Firefox ESR, and Thunderbird should be aware of this vulnerability and update their products to the latest versions. Additionally, developers who use libvpx in their applications should ensure that they are using a patched version of the library. Organizations that use Mozilla products should prioritize patching this vulnerability to prevent potential attacks.

Technical summary

The vulnerability is a heap buffer overflow in libvpx, which can be exploited by attackers to execute arbitrary code. The vulnerability was introduced in an unspecified version of libvpx and was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. The CVE has a CVSS score of 8.8 and a CVSS severity of HIGH. The vulnerability can be exploited remotely, and user interaction is required.

Defensive priority

High

Recommended defensive actions

Update Firefox to version 147.0.4 or later
Update Firefox ESR to version 140.7.1 or later
Update Firefox ESR to version 115.32.1 or later
Update Thunderbird to version 140.7.2 or later
Update Thunderbird to version 147.0.2 or later

Evidence notes

The CVE was published on February 16, 2026, and last modified on June 30, 2026. The vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. The CVE has a CVSS score of 8.8 and a CVSS severity of HIGH.

Sources and references

Verified primary and authoritative sources

CVE-2026-2447 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-2447

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-2447 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2447

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Mitigation or vendor reference
Unverified legacy reference

URL: https://www.mozilla.org/security/advisories/mfsa2026-10/

[email protected] - Vendor Advisory
Mitigation or vendor reference
Unverified legacy reference

URL: https://www.mozilla.org/security/advisories/mfsa2026-11/

[email protected] - Vendor Advisory
Source reference
Unverified legacy reference

URL: https://lists.debian.org/debian-lts-announce/2026/02/msg00028.html

af854a3a-2127-422b-91ae-364da2661108
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:16174

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:3338

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://access.redhat.com/errata/RHSA-2026:3339

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.