CVE-2026-2759 Mozilla CVE debrief

Who should care

This vulnerability affects users of Mozilla Firefox, particularly those using versions prior to 148, Firefox ESR versions prior to 115.33 and 140.8, and Thunderbird versions prior to 148 and 140.8. Given the critical severity and potential for code execution, administrators and users of these affected products should prioritize patching to prevent exploitation.

Technical summary

The CVE-2026-2759 vulnerability is caused by incorrect boundary conditions in the Graphics: ImageLib component of Mozilla Firefox. This issue can lead to arbitrary code execution, making it a critical concern for users of affected versions. The vulnerability was addressed through updates in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high level of severity across various metrics.

Defensive priority

Given the critical severity of CVE-2026-2759 and its potential for arbitrary code execution, immediate patching is advised for all affected products. Prioritize updates to Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8 to mitigate risks.

Recommended defensive actions

• Update Firefox to version 148 or later.
• Update Firefox ESR to version 115.33 or later.
• Update Firefox ESR to version 140.8 or later.
• Update Thunderbird to version 148 or later.
• Update Thunderbird to version 140.8 or later.
• Verify that all affected systems and user workstations have the latest security patches applied.

Evidence notes

The CVE-2026-2759 vulnerability was publicly disclosed on February 24, 2026, with a CVSS score of 9.8. The issue was addressed by Mozilla through updates in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Multiple references, including vendor advisories and issue tracking links, are available for further information.

Official resources