CVE-2026-2788: 
NixOS vulnerability analysis and mitigation

CVE-2026-2788 is a memory buffer boundary condition vulnerability in the Audio/Video: GMP (Gecko Media Plugin) component of Mozilla Firefox and Thunderbird. The flaw involves incorrect boundary conditions that can lead to improper memory operations (CWE-119). It affects Firefox prior to version 148, Firefox ESR prior to 115.33, Firefox ESR prior to 140.8, Thunderbird prior to 148, and Thunderbird ESR prior to 140.8. Mozilla disclosed and patched the vulnerability on February 24, 2026, across multiple security advisories (MFSA2026-13 through MFSA2026-17). The Feedly-estimated CVSS v3.1 base score is 9.8 (Critical), though Mozilla's own advisories rate the impact as moderate (Mozilla MFSA2026-13, Mozilla MFSA2026-15, Feedly).

The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and stems from incorrect boundary conditions in Firefox's Audio/Video GMP (Gecko Media Plugin) subsystem, which handles media codec processing. The GMP component interfaces with external media plugins (such as those used for audio/video decoding), and improper bounds checking in this interface can allow out-of-bounds memory reads or writes. The vulnerability was discovered and reported by a team of researchers — Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger — using Claude from Anthropic, and is tracked internally as Mozilla Bug 2014824 (Mozilla MFSA2026-13, Mozilla MFSA2026-15). No public proof-of-concept exploit code has been identified.

Successful exploitation of this vulnerability could result in memory corruption within the Firefox or Thunderbird process, potentially enabling arbitrary code execution in the context of the browser or email client. Depending on exploitation success, an attacker could achieve unauthorized access to sensitive data (high confidentiality impact), modify application state or data (high integrity impact), or cause application crashes (high availability impact). Because the GMP component processes media content loaded from web pages or email, exploitation could be triggered by a user visiting a malicious website or opening a crafted email with media content (Mozilla MFSA2026-13, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a low current probability of exploitation in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was identified through AI-assisted security research using Anthropic's Claude model, as part of a broader research effort that uncovered numerous issues in the same Firefox release cycle (Mozilla MFSA2026-13).

Mozilla has released patched versions addressing CVE-2026-2788 across all affected product lines. Users and administrators should upgrade to: Firefox 148 or later, Firefox ESR 115.33 or later, Firefox ESR 140.8 or later, Thunderbird 148 or later, or Thunderbird ESR 140.8 or later. No configuration-based workaround is available; upgrading to a fixed version is the only recommended remediation. Organizations managing enterprise deployments should prioritize patching given the media-processing attack surface exposed to untrusted content (Mozilla MFSA2026-13, Mozilla MFSA2026-14, Mozilla MFSA2026-15).

The vulnerability was part of a large batch of security fixes released by Mozilla on February 24, 2026, many of which were discovered using AI-assisted research (Claude from Anthropic), drawing notable attention from the security community regarding the role of AI in vulnerability discovery. Red Hat, Debian, SUSE, Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux, and Slackware all issued downstream advisories and updated packages shortly after Mozilla's disclosure. The VulnCheck blog specifically highlighted the Anthropic/Claude-assisted CVEs from this release cycle as a notable development in AI-aided security research (VulnCheck Blog, Red Hat CVE).