CVE-2026-2779: 
NixOS vulnerability analysis and mitigation

CVE-2026-2779 is a memory safety vulnerability caused by incorrect boundary conditions in the Networking: JAR component of Mozilla Firefox and Thunderbird. It was reported by Alex Mayorga (originally filed as Bugzilla bug 1164141 over a decade ago) and publicly disclosed on February 24, 2026, when Mozilla released patched versions. Affected products include Firefox before 148, Firefox ESR before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. Mozilla rates the impact as moderate, while the NVD assigns a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15, Bugzilla #1164141).

The vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and stems from incorrect boundary checks in the nsZipArchive::GetDataOffset(nsZipItem*) function within Mozilla's JAR (Java Archive) networking component (modules/libjar/nsZipArchive.cpp). Specifically, when processing a ZIP/JAR archive, the code computes a local file header offset (aItem->LocalOffset()) and performs a length check against the mapped file data, but under certain conditions — such as a corrupt or maliciously crafted JAR file — the offset can reference memory outside the valid buffer, leading to an out-of-bounds read or crash. The bug was originally observed as a crash during shutdown or startup when loading JAR-based components (e.g., JS modules loaded via mozJSComponentLoader), and crash signatures include [@ nsZipArchive::GetDataOffset] and [@ shutdownhang | nsTHashtable::s_HashKey | nsZipArchive::GetDataOffset]. No user interaction is required for the vulnerable code path to be triggered in certain configurations (Bugzilla #1164141, Mozilla Advisory mfsa2026-13).

Successful exploitation of this vulnerability could result in application crashes (denial of service), potential information disclosure through out-of-bounds memory reads, or — depending on how the boundary condition is leveraged — memory corruption that could theoretically enable arbitrary code execution. The vulnerability affects widely deployed client-side software (Firefox and Thunderbird) across all platforms (Windows, macOS, Linux, Android), meaning a large number of end-user systems are potentially at risk. Mozilla's own severity assessment is moderate, suggesting that while memory corruption is possible, reliable code execution is considered difficult to achieve in practice (Mozilla Advisory mfsa2026-13, Bugzilla #1164141).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The bug has been present in the codebase for over a decade (originally filed in 2015) but was only recently triaged as a security issue and patched.

Mozilla has released fixes in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8, all announced on February 24, 2026. Users and administrators should update all affected Mozilla products to these versions or later immediately. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize patching user-facing browser and email client deployments, and consider restricting access to untrusted websites or email attachments containing JAR files until patches are fully deployed (Mozilla Advisory mfsa2026-13, Mozilla Advisory mfsa2026-15).

Mozilla rated this vulnerability as moderate impact in its official advisories, a notable contrast to the NVD's CVSS 9.8 Critical score — likely reflecting Mozilla's assessment that reliable exploitation for code execution is difficult. The bug had been open for over 10 years in Bugzilla before being formally classified as a security issue and patched, which drew some attention to the long-standing nature of the defect. Downstream Linux distributions including Red Hat, Debian, SUSE, Slackware, AlmaLinux, Rocky Linux, and Oracle Linux issued their own security advisories and package updates following Mozilla's disclosure (Mozilla Advisory mfsa2026-13, Bugzilla #1164141).