CVE-2026-0892: 
NixOS vulnerability analysis and mitigation

CVE-2026-0892 is a memory safety vulnerability affecting Mozilla Firefox 146 and Thunderbird 146, involving multiple memory corruption bugs that could potentially be exploited to execute arbitrary code. It was reported by Hiroyuki Ikezoe, Jon Coppeard, Maurice Dauer, and the Mozilla Fuzzing Team, and publicly disclosed on January 13, 2026, via Mozilla Foundation Security Advisory 2026-01. The vulnerability affects Firefox versions prior to 147.0 and Thunderbird versions prior to 147.0. Mozilla rated its impact as Moderate, while CISA-ADP assigned a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory, Feedly).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), encompassing multiple memory safety bugs discovered through fuzzing and manual research (Mozilla Advisory). The specific bugs are tracked in Mozilla Bugzilla under IDs 1986912, 1996718, 1999633, 2001081, and 2004443. Some of these bugs showed evidence of memory corruption, and Mozilla assessed that with sufficient effort, they could be leveraged to achieve arbitrary code execution. Unlike the related CVE-2026-0891 (which also affects ESR branches), CVE-2026-0892 is specific to the non-ESR Firefox 146 and Thunderbird 146 release lines (Mozilla Advisory).

Successful exploitation of CVE-2026-0892 could allow an attacker to achieve arbitrary code execution within the context of the browser or email client process, potentially compromising the confidentiality, integrity, and availability of the affected system. Given the network-accessible attack vector and no required user interaction per the CVSS scoring, a remote attacker could theoretically trigger memory corruption through crafted web content or email messages. The scope of impact is limited to the affected application's process, though browser-level code execution can serve as a foothold for further system compromise (Mozilla Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation for CVE-2026-0892 (Feedly). The EPSS score is approximately 0.043%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported in connection with this CVE.

Mozilla has released fixed versions addressing CVE-2026-0892: Firefox 147 and Thunderbird 147, both released on January 13, 2026 (Mozilla Advisory). Users and administrators should update to Firefox 147 or later and Thunderbird 147 or later immediately. No configuration-based workarounds are available; upgrading to the patched version is the only recommended remediation. Organizations using managed deployments should prioritize pushing the update through their software management infrastructure.

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Mozilla products, including CVE-2026-0892, could allow for arbitrary code execution, recommending prompt patching (CIS Advisory). Red Hat tracked the vulnerability and opened a corresponding Bugzilla entry. Security news outlets including CyberSecurityNews and CyberInsider covered the Firefox 147 release in the context of its security fixes. Community sentiment was generally measured, noting that while the CVSS score assigned by CISA-ADP is 9.8, Mozilla itself rated the impact as only "Moderate," reflecting the theoretical rather than demonstrated exploitability of the memory safety bugs.