CVE-2026-2774: 
NixOS vulnerability analysis and mitigation

CVE-2026-2774 is an integer overflow vulnerability in the Audio/Video component of Mozilla Firefox and Thunderbird. It was discovered and reported by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic, and was publicly disclosed on February 24, 2026. Affected products include Firefox < 148, Firefox ESR < 115.33, Firefox ESR 128.x < 140.8, Thunderbird < 148, and Thunderbird ESR < 140.8. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15, Feedly).

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) and is associated with CAPEC-92 (Forced Integer Overflow). It resides in the Audio/Video processing component of Firefox and Thunderbird, where insufficient bounds checking on integer arithmetic can lead to a wraparound condition, potentially resulting in memory corruption or arbitrary code execution. The attack vector is network-based, requires no privileges and no user interaction, and has low attack complexity, making it trivially exploitable by a remote unauthenticated attacker who can deliver malicious audio/video content to a vulnerable browser or email client (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-14, Feedly). The underlying bug is tracked as Bugzilla bug 2014883, though the report is access-restricted.

Successful exploitation of CVE-2026-2774 can result in complete compromise of the affected system, with high impact to confidentiality, integrity, and availability. An attacker could achieve arbitrary code execution in the context of the browser or email client process, potentially enabling access to sensitive user data, modification of system files, or denial of service. Given the network-accessible attack vector and no user interaction requirement, exploitation could be triggered simply by a victim visiting a malicious webpage or opening a crafted email with audio/video content in Thunderbird (Mozilla Advisory mfsa2026-13, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. However, the critical CVSS score of 9.8 and the zero-interaction network attack vector make this a high-priority target for future weaponization.

Mozilla has released patches addressing CVE-2026-2774 in the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Users and administrators should update to these versions immediately. No configuration-based workaround is available; upgrading is the only effective remediation. Organizations should prioritize automated patch deployment given the critical severity and zero-interaction exploitability of this vulnerability (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-14, Mozilla Advisory mfsa2026-15).

The vulnerability was part of a large batch of security fixes released by Mozilla on February 24, 2026, many of which were discovered using AI-assisted security research (Claude from Anthropic), which drew notable attention in the security community. VulnCheck published a blog post specifically discussing CVEs credited to Anthropic's AI tooling in this release cycle (VulnCheck Blog). Downstream Linux distributions including Red Hat, Debian, SUSE, Rocky Linux, AlmaLinux, Oracle Linux, Slackware, and Amazon Linux rapidly issued their own advisories and updated packages, reflecting broad industry recognition of the severity of this vulnerability batch.