CVE-2026-2789: 
NixOS vulnerability analysis and mitigation

CVE-2026-2789 is a use-after-free vulnerability in the Graphics: ImageLib component of Mozilla Firefox and Thunderbird. It was discovered by Evyatar Ben Asher, Keane Lucas, Nicholas Carlini, Newton Cheng, Daniel Freeman, Alex Gaynor, and Joel Weinberger using Claude from Anthropic, and publicly disclosed on February 24, 2026. Affected products include Firefox before 148, Firefox ESR before 115.33, Firefox ESR before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. The Feedly threat intelligence data assigns a CVSS v3.1 base score of 9.8 (Critical), though Mozilla's own advisories rate the impact as "moderate" for this specific CVE (Mozilla MFSA2026-13, Mozilla MFSA2026-15, Feedly).

The vulnerability is classified as CWE-416 (Use After Free) and resides in Firefox's Graphics: ImageLib component, which handles image decoding and rendering. A use-after-free occurs when the program continues to use a memory pointer after the referenced memory has been freed, potentially allowing an attacker to control the freed memory region and redirect execution flow. The bug is tracked internally as Mozilla Bug 2015179, though the full technical details are restricted. The vulnerability was identified through AI-assisted security research using Anthropic's Claude model, as part of a broader research effort that uncovered numerous memory safety issues in the same release cycle (Mozilla MFSA2026-13, Mozilla MFSA2026-14).

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code in the context of the browser or email client process, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. Because the vulnerability resides in the image processing library, it could be triggered by rendering a maliciously crafted image delivered via a web page or email attachment. The broad deployment of Firefox and Thunderbird across enterprise and consumer environments significantly expands the potential attack surface (Feedly, Mozilla MFSA2026-13).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, indicating a low current probability of exploitation in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. The Feedly CVSS estimate of 9.8 (network-accessible, no authentication, no user interaction required) contrasts with Mozilla's own "moderate" severity rating for this specific CVE, suggesting the actual exploitability may be more constrained than the automated score implies.

Mozilla has released patches addressing CVE-2026-2789 in the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird ESR 140.8. Organizations should immediately update all affected Firefox and Thunderbird installations to these versions or later. No configuration-based workaround is available; upgrading is the only remediation. Enterprise administrators should prioritize patching given the broad deployment of these products and the potential for drive-by exploitation via malicious image content (Mozilla MFSA2026-13, Mozilla MFSA2026-14, Mozilla MFSA2026-15).

The vulnerability was part of a large batch of security fixes released by Mozilla on February 24, 2026, many of which were discovered using AI-assisted research with Anthropic's Claude model — a notable development that drew attention from the security community and was covered by VulnCheck in a dedicated blog post (VulnCheck Blog). Downstream Linux distributions including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, and Slackware issued their own advisories and updated packages shortly after Mozilla's disclosure. The use of AI tooling to discover browser memory safety vulnerabilities at scale was highlighted as a significant trend in vulnerability research.