CVE-2026-0886: 
NixOS vulnerability analysis and mitigation

CVE-2026-0886 is a vulnerability caused by incorrect boundary conditions in the Graphics component of Mozilla Firefox and Thunderbird, resulting in an out-of-bounds read of arbitrary size and offset from the browser process. It was reported by external researcher Oskar L, disclosed on January 13, 2026, and fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. The vulnerability has a CVSS v3.1 base score of 5.3 (Medium), assessed by CISA-ADP (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119) in the Cairo-based graphics rendering pipeline (DrawTargetCairo.cpp). When a pattern surface is used for drawing, the function GetCairoSurfaceForSourceSurface passes an attacker-controlled subimage rectangle to CreateSubImageForData without validating that the rectangle is contained within the source surface bounds. This allows the computed data pointer (aData + aRect.Y() * aStride + aRect.X() * BytesPerPixel(aFormat)) to reference memory outside the allocated surface buffer, which is then used to create a new Cairo image surface and subsequently read during drawing operations such as StrokeRect. The vulnerability is exploitable via the printing subsystem — a content process can supply crafted drawing parameters that cause the browser process to perform an out-of-bounds read of arbitrary size and offset. The bug was found through manual code auditing and is related to (but distinct from) CVE-2026-0880, which addressed integer overflow in the same area (Mozilla Bugzilla).

Successful exploitation results in an out-of-bounds read of heap memory from the browser (parent) process, with the attacker able to control both the size and offset of the read. The primary impact is a limited confidentiality breach — memory contents from the browser process could potentially be disclosed. Integrity and availability are not directly affected. Mozilla's internal analysis concluded that while the bug was initially classified as a potential sandbox escape, data obtained via the out-of-bounds read during printing is rendered into the print output rather than being directly accessible to the attacking page, limiting practical exploitability on its own; however, it could potentially be chained with other vulnerabilities (Mozilla Bugzilla, Mozilla Advisory mfsa2026-01).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-0886. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla classified the severity as "moderate" after internal review determined that the out-of-bounds read data is not directly accessible to the attacking page in the primary attack scenario (printing), reducing practical exploitability (Mozilla Bugzilla, Mozilla Advisory mfsa2026-01).

1. Setup: Host a malicious web page that triggers the Firefox print dialog (e.g., via window.print() in JavaScript), causing the content process to invoke the printing/rendering pipeline.
2. Craft malicious drawing parameters: From the content process, supply a SurfacePattern with an IntRect subimage whose origin coordinates (X, Y) are set to large values (e.g., IntRect(0x100000, 0, 0x100, 1)) that extend beyond the bounds of the actual source surface data.
3. Trigger out-of-bounds read: When the browser process renders the print output, GetCairoSurfaceForSourceSurface passes the unchecked subimage rect to CreateSubImageForData, which computes a data pointer offset far outside the allocated surface buffer. Cairo then reads from this out-of-bounds memory region during the StrokeRect drawing operation.
4. Data exposure: The out-of-bounds heap memory from the browser process is incorporated into the rendered print output (e.g., PDF). An attacker would need an additional mechanism to extract and interpret this data, as it is not directly returned to the content process (Mozilla Bugzilla).

Mozilla has released patches addressing this vulnerability. Users should upgrade to Firefox 147 or later, Firefox ESR 115.32 or later, Firefox ESR 140.7 or later, Thunderbird 147 or later, or Thunderbird ESR 140.7 or later. The fix adds validation of the sampling rectangle against the actual data surface size in DrawTargetCairo.cpp, ensuring that subimage coordinates cannot exceed the bounds of the allocated buffer. No configuration-based workaround is available; upgrading to a patched version is the only remediation (Mozilla Advisory mfsa2026-01, Mozilla Advisory mfsa2026-02, Mozilla Advisory mfsa2026-03).

The CIS (Center for Internet Security) published an advisory noting multiple vulnerabilities in Mozilla products that could allow for arbitrary code execution, grouping CVE-2026-0886 with the broader Firefox 147 release. Red Hat, Debian, Slackware, Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux, and SUSE all issued downstream security advisories and updated packages. The vulnerability received a security bounty from Mozilla, confirming it was reported by an external researcher (Oskar L) through the Mozilla bug bounty program. Community and media coverage was primarily focused on the higher-severity sandbox escape vulnerabilities (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880) in the same release batch, with CVE-2026-0886 receiving less individual attention due to its moderate severity rating (Mozilla Bugzilla, Mozilla Advisory mfsa2026-01).