CVE-2026-2772: 
NixOS vulnerability analysis and mitigation

CVE-2026-2772 is a use-after-free vulnerability in the Audio/Video: Playback component of Mozilla Firefox and Thunderbird. It was disclosed on February 24, 2026, as part of Mozilla's coordinated security advisory release (MFSA2026-13 through MFSA2026-17). Affected versions include Firefox before 148, Firefox ESR before 115.33, Firefox ESR before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

The vulnerability is classified as CWE-416 (Use After Free), occurring in the Audio/Video: Playback component of Firefox and Thunderbird. A use-after-free condition arises when the browser's media playback subsystem accesses memory that has already been freed, potentially allowing an attacker to control the freed memory region and redirect execution flow. The flaw was discovered by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic, and is tracked internally as Bug 2014827. The attack vector is network-based, requires no privileges, and no user interaction, making it exploitable by any remote attacker who can deliver malicious media content to a vulnerable browser or email client (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14).

Successful exploitation of CVE-2026-2772 could result in complete compromise of confidentiality, integrity, and availability on the affected system, as reflected in the CVSS score of 9.8. An attacker could achieve arbitrary code execution in the context of the browser or email client process, potentially enabling unauthorized access to sensitive user data, modification of system state, or denial of service. Given that both Firefox and Thunderbird are widely deployed across enterprise and consumer environments, the attack surface is broad, and exploitation could serve as an initial foothold for further lateral movement within a network (Mozilla Advisory MFSA2026-15, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. However, the critical CVSS score and the no-user-interaction attack vector make this a high-priority patching target should weaponized exploits emerge.

Mozilla has released patched versions addressing CVE-2026-2772: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately update all Firefox and Thunderbird installations to these versions or later. As an interim measure until patching is possible, administrators should restrict the use of affected browsers for accessing untrusted content and avoid opening media files from unknown sources in Thunderbird. Downstream Linux distributions including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, and Slackware have also released updated packages (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

The vulnerability was part of a large batch of security fixes released by Mozilla on February 24, 2026, covering dozens of high-severity issues across Firefox and Thunderbird. Notably, several of the co-reported vulnerabilities in the same advisory batch — including CVE-2026-2772 — were discovered using Claude from Anthropic, drawing attention from the security community to AI-assisted vulnerability research. VulnCheck published a blog post specifically discussing Anthropic-credited CVEs from this release cycle (VulnCheck Blog). Downstream vendors including Red Hat, Debian, SUSE, and others promptly issued their own advisories and updated packages following Mozilla's disclosure.