PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-2774 Mozilla CVE debrief

CVE-2026-2774 is a critical vulnerability in the Audio/Video component of Firefox, caused by an integer overflow. The vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.8, indicating a critical severity. The vulnerability was publicly disclosed on February 24, 2026, and the information was last modified on June 30, 2026. Multiple sources, including Mozilla and Red Hat, have provided advisories and patches for this vulnerability.

Vendor
Mozilla
Product
Firefox
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-24
Original CVE updated
2026-07-15
Advisory published
2026-02-24
Advisory updated
2026-07-15

Who should care

Organizations and individuals using Firefox, Firefox ESR, Thunderbird, or other affected products should prioritize patching this vulnerability. The vulnerability's critical severity and potential for exploitation make it essential for defenders to take immediate action. Red Hat and other vendors have also provided errata and patches for their affected products.

Technical summary

The CVE-2026-2774 vulnerability is caused by an integer overflow in the Audio/Video component of Firefox. This vulnerability can be exploited remotely, and its critical CVSS score indicates a high likelihood of exploitation. The vulnerability affects multiple versions of Firefox, including Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The Common Vulnerability and Exposure (CVE) scoring system rates this vulnerability as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

Defenders should prioritize patching CVE-2026-2774 due to its critical severity and potential for exploitation. Immediate action is necessary to prevent potential attacks.

Recommended defensive actions

  • Apply patches for Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
  • Review and apply Red Hat errata and patches for affected products.
  • Verify that all affected products are updated to the latest versions.
  • Monitor for potential exploitation attempts and anomalies.
  • Consider implementing compensating controls, such as network segmentation or access restrictions, for high-risk environments.

Evidence notes

The CVE-2026-2774 vulnerability was publicly disclosed on February 24, 2026, and the information was last modified on June 30, 2026. Multiple sources, including Mozilla and Red Hat, have provided advisories and patches for this vulnerability. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 9.8, indicating a critical severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-2774 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-2774

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-2774 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2774

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.