CVE-2026-2757: 
NixOS vulnerability analysis and mitigation

CVE-2026-2757 is an out-of-bounds read/write vulnerability caused by incorrect boundary conditions in the WebRTC: Audio/Video component (WebrtcGmpVideoDecoder::Decode_g) of Mozilla Firefox and Thunderbird. Discovered and reported by Igor Morgenstern of Aisle Research, it was publicly disclosed on February 24, 2026. Affected products include Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8 (ESR 128.x branch), Thunderbird < 148, and Thunderbird ESR < 140.8. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Feedly).

The root cause is an insufficient input size validation in WebrtcGmpVideoDecoder::Decode — the function only rejects zero-length EncodedImage buffers, allowing 1–3 byte buffers to proceed to Decode_g. In Decode_g, a buffer of aDecodeData->mImage.size() bytes is allocated, then a 4-byte header is unconditionally written (*(uint32_t*)frame->Buffer() = frame->Size()) and frame->Size() - 4 bytes are copied via memcpy. For inputs of 1–3 bytes, the 4-byte header write overruns the allocation and the size - 4 subtraction underflows (integer underflow), causing an out-of-bounds write and read in the GMP (Gecko Media Plugin) process. This maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). A malicious WebRTC peer can deliver such undersized H.264 encoded frames when the GMP decoder path is active. A proof-of-concept using RTCRtpScriptTransform to truncate frames to 3 bytes before decode was included in the original bug report (Mozilla Bugzilla).

Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected browser or email client process. An attacker acting as a malicious WebRTC peer can trigger an out-of-bounds memory write/read in the GMP process, potentially enabling arbitrary code execution within the browser's GMP sandbox. While the GMP process provides some isolation, the high CVSS score reflects the network-accessible, no-authentication-required nature of the attack, and the potential for further exploitation if combined with a sandbox escape (Mozilla Bugzilla, Feedly).

A functional proof-of-concept was submitted by the reporter alongside the bug report, consisting of an HTML page and a Web Worker script that establishes a local WebRTC loopback, negotiates H.264, and uses RTCRtpScriptTransform to truncate frames to 3 bytes before decode — confirmed to trigger an ASan out-of-bounds write (Mozilla Bugzilla). No evidence of in-the-wild exploitation has been reported, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term) (Feedly). No threat actor attribution is available.

1. Setup malicious WebRTC endpoint: Host a web page that initiates a WebRTC session with the target browser, negotiating H.264 video using the GMP decoder path (requires media.navigator.mediadatadecoder_h264_enabled=false and media.navigator.mediadatadecoder_vpx_enabled=false on the victim, or targeting configurations where GMP H.264 is the fallback decoder).
2. Enable RTCRtpScriptTransform: Use the RTCRtpScriptTransform API on the receiver side to intercept encoded video frames before they reach the decoder (media.peerconnection.scripttransform.enabled=true).
3. Truncate encoded frames: In the transform worker script, intercept each RTCEncodedVideoFrame and replace its data with a 1–3 byte buffer (e.g., a 3-byte ArrayBuffer), then enqueue the truncated frame.
4. Trigger out-of-bounds write: The truncated frame is passed to WebrtcGmpVideoDecoder::Decode, which passes the size check (non-zero), then proceeds to Decode_g where a 4-byte header write overruns the allocated buffer and the memcpy with underflowed size causes an out-of-bounds read.
5. Achieve code execution: Leverage the memory corruption in the GMP process to gain code execution, potentially chaining with a sandbox escape for full system compromise (Mozilla Bugzilla).

• Process: Unexpected crashes or crash dumps originating from the Firefox/Thunderbird GMP (Gecko Media Plugin) process, particularly in WebrtcGmpVideoDecoder::Decode_g stack frames.
• Logs: ASan or crash reporter logs referencing out-of-bounds access in dom/media/webrtc/libwebrtcglue/WebrtcGmpVideoCodec.cpp; browser crash reports with signatures involving WebrtcGmpVideoDecoder.
• Network: Unusual WebRTC session establishment with peers delivering very small (1–3 byte) H.264 encoded video frames; unexpected use of RTCRtpScriptTransform in WebRTC sessions from untrusted origins.
• File System: Crash dump files (.dmp, minidumps) generated by the Firefox/Thunderbird GMP plugin process in the browser's crash reports directory (Mozilla Bugzilla).

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8, all released on February 24, 2026. The fix adds a size check in WebrtcGmpVideoDecoder::Decode_g to reject EncodedImage buffers smaller than 4 bytes before any memory operations are performed. Users should update to the patched versions immediately. As a temporary workaround (not recommended for production), disabling WebRTC via media.peerconnection.enabled=false in about:config would prevent exploitation but also disables all WebRTC functionality (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

The vulnerability received a security bounty from Mozilla, confirming its significance. Multiple Linux distributions (Red Hat, Debian, SUSE, Slackware, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux) issued downstream security advisories and package updates shortly after the Mozilla disclosure. Vulnerability scanners including Nessus and Qualys added detection plugins for this CVE across multiple platforms. No notable independent researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard patch tracking (Mozilla Bugzilla, Feedly).