CVE-2026-2792: 
NixOS vulnerability analysis and mitigation

CVE-2026-2792 is a memory safety vulnerability affecting Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR, classified as "Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148." The bugs were present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147, with some showing evidence of memory corruption that Mozilla assessed could potentially be exploited to run arbitrary code. It was disclosed on February 24, 2026, via Mozilla Foundation Security Advisories MFSA2026-13, MFSA2026-15, MFSA2026-16, and MFSA2026-17. Affected versions include Firefox prior to 148.0, Firefox ESR prior to 140.8.0, Thunderbird prior to 148.0, and Thunderbird ESR prior to 140.8.0. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-15, Mozilla Advisory MFSA2026-13).

CVE-2026-2792 is classified under CWE-787 (Out-of-bounds Write) and encompasses a collection of memory safety bugs reported by Andrew McCreight, Maurice Dauer, Olli Pettay, and Ryan Hunt. The underlying issues involve memory corruption conditions — such as out-of-bounds writes — within the browser engine that could be triggered through crafted web content or email messages processed by the affected applications. Because these are memory safety bugs spanning multiple components, the precise attack surface is broad, potentially including JavaScript engine internals, DOM processing, and media handling. No specific technical write-up or public proof-of-concept code detailing individual exploitation mechanics has been published (Mozilla Advisory MFSA2026-15, Mozilla Advisory MFSA2026-13).

Successful exploitation of CVE-2026-2792 could allow a remote attacker to achieve arbitrary code execution on the affected system, compromising confidentiality, integrity, and availability. An attacker could leverage a malicious webpage or email to trigger memory corruption in the browser or email client, potentially gaining the same privileges as the running process. This could enable data theft, installation of malware, or use of the compromised endpoint as a pivot point for further lateral movement within a network (Mozilla Advisory MFSA2026-15, Feedly).

As of the time of disclosure, there is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation of CVE-2026-2792. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term (Feedly).

Mozilla has released patched versions addressing CVE-2026-2792: users should update to Firefox 148 or later, Firefox ESR 140.8 or later, Thunderbird 148 or later, and Thunderbird ESR 140.8 or later. No configuration-based workaround is available; upgrading to a fixed version is the only recommended remediation. Enterprise administrators should prioritize deployment of these updates given the high severity rating and potential for arbitrary code execution. Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux, and Slackware have all issued downstream advisories and updated packages (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).

Mozilla issued coordinated security advisories (MFSA2026-13, MFSA2026-15, MFSA2026-16, MFSA2026-17) on February 24, 2026, covering CVE-2026-2792 alongside a large batch of other high-severity vulnerabilities fixed in the same release cycle. Multiple Linux distribution vendors — including Red Hat, Debian, SUSE, AlmaLinux, Rocky Linux, Oracle Linux, and Amazon Linux — promptly issued their own security errata. Security media such as Cyber Insider noted the Firefox 148 release as significant for its breadth of security fixes (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15).