CVE-2026-2759: 
NixOS vulnerability analysis and mitigation

CVE-2026-2759 is an out-of-bounds read vulnerability in the Graphics: ImageLib component of Mozilla Firefox and Thunderbird, specifically within the AVIFDecoderStream::ReadAt function due to missing offset validation when processing AVIF image files. It was discovered by researcher Steven Julian and disclosed on February 24, 2026, as part of Mozilla's coordinated security release. Affected versions include Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird ESR < 140.8. The vulnerability carries an estimated CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Feedly).

The root cause is an out-of-bounds read (CWE-787 estimated; more precisely an out-of-bounds read/write boundary condition error) in AVIFDecoderStream::ReadAt within image/decoders/nsAVIFDecoder.cpp. The function computes the read size as mBuffer->length() - offset without first validating that offset is non-negative and within buffer bounds; because the subtraction is cast to size_t, a negative or out-of-range offset causes an integer underflow, yielding a very large size value, which is then passed to memcpy, reading past the end of the buffer. Unlike the analogous BufferStream::ReadAt in dom/media/mp4/BufferStream.cpp, which validates offsets and returns NS_ERROR_DOM_MEDIA_RANGE_ERR, the AVIF stream adapter lacked these checks. Additionally, SampleIterator only validates mByteRange.mEnd <= length but does not enforce mByteRange.mStart >= 0 or that 64-bit offsets from mp4parse fit into int64, leaving a path for attacker-controlled offsets from a malicious AVIF file to reach the vulnerable code (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).

Successful exploitation could allow a remote attacker to read memory beyond the bounds of an allocated buffer when the browser or email client processes a specially crafted AVIF image, potentially leading to information disclosure, memory corruption, application crashes (denial of service), or — with sufficient effort — arbitrary code execution. The vulnerability affects all major platforms including Android, and because it is triggered through image parsing (a passive operation), it could be exploited simply by a user visiting a malicious web page or opening a malicious email in Thunderbird. High confidentiality, integrity, and availability impacts are assessed given the network-accessible, no-user-interaction attack vector (Mozilla Bugzilla, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). Mozilla's internal assessment noted that while the out-of-bounds read is likely achievable, converting it into a reliable exploit would be difficult due to existing sanity checks in SampleIterator that an attacker would need to bypass. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious AVIF file: Create a specially crafted AVIF image file containing mp4parse-derived 64-bit byte range offsets that, when copied into MediaByteRange (int64), overflow to negative values or exceed the buffer length, bypassing SampleIterator's mEnd <= length check.
2. Deliver the payload: Host the malicious AVIF file on an attacker-controlled web server, or embed it in an HTML page or email message targeting Firefox or Thunderbird users.
3. Trigger image parsing: Lure the victim to visit the malicious page (Firefox) or open/preview the malicious email (Thunderbird). The browser/client automatically invokes AVIFDecoderStream::ReadAt to decode the image.
4. Trigger out-of-bounds read: The crafted offset causes mBuffer->length() - offset to underflow to a large size_t value; memcpy then reads memory beyond the buffer boundary.
5. Achieve objective: Depending on memory layout and additional exploitation primitives, the attacker may leak sensitive memory contents (information disclosure), cause a crash (DoS), or — with significant additional effort — achieve code execution (Mozilla Bugzilla).

• Network: Unusual HTTP requests fetching .avif image files from unknown or suspicious domains; outbound connections from Firefox/Thunderbird processes to unexpected hosts following image rendering.
• Process: Browser or email client crashes (crash reports referencing nsAVIFDecoder, AVIFDecoderStream, or ImageLib); unexpected child processes spawned by Firefox or Thunderbird.
• Logs: ASan/crash logs referencing AVIFDecoderStream::ReadAt, nsAVIFDecoder.cpp, or out-of-bounds memory access in the image decoding pipeline.
• File System: Unexpected AVIF files downloaded to the browser cache directory with anomalous sizes or structures.

Mozilla has released patched versions addressing this vulnerability: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users and administrators should update to these versions immediately. Enabling automatic updates in Firefox and Thunderbird is strongly recommended to ensure timely patching. No configuration-based workaround is available; upgrading is the only effective remediation. Linux distribution vendors (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) have also released updated packages (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

Mozilla awarded a security bounty to the reporter (Steven Julian) and classified the vulnerability as sec-high. The fix was uplifted to all supported ESR branches and beta, reflecting the severity assessment. Multiple Linux distribution vendors (Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Slackware, Amazon Linux) issued security advisories and updated packages shortly after Mozilla's disclosure, indicating broad ecosystem response. No notable independent researcher commentary or significant social media discussion beyond standard vulnerability tracking has been observed (Mozilla Bugzilla, Mozilla Advisory MFSA2026-13).