CVE-2026-2793: 
NixOS vulnerability analysis and mitigation

CVE-2026-2793 is a memory safety vulnerability affecting Mozilla Firefox, Firefox ESR, and Thunderbird, classified as an out-of-bounds write (CWE-787). The vulnerability involves multiple memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147, some of which showed evidence of memory corruption that could potentially be exploited to execute arbitrary code. It was disclosed on February 24, 2026, by reporters Andrew McCreight and Christian Holler, and is addressed in Mozilla security advisories MFSA2026-13, MFSA2026-14, and MFSA2026-15. Affected versions include Firefox before 148, Firefox ESR before 115.33, Firefox ESR (128+) before 140.8, Thunderbird before 148, and Thunderbird ESR before 140.8. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-15, Feedly).

The root cause is classified as CWE-787 (Out-of-bounds Write), stemming from multiple memory safety bugs across Firefox and Thunderbird's internal components. The specific bugs are tracked in Mozilla's Bugzilla under bug IDs 2015196, 2016423, and 2016498. The attack vector is network-based with low complexity, requiring no privileges and no user interaction, meaning a remote attacker could trigger memory corruption simply by delivering malicious content (e.g., a crafted web page or email) to a vulnerable browser or email client. Mozilla's advisory notes that while some bugs showed evidence of memory corruption, exploitation to achieve arbitrary code execution would require "enough effort," suggesting the bugs are not trivially weaponizable but are theoretically exploitable (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14).

Successful exploitation of CVE-2026-2793 could allow a remote attacker to execute arbitrary code on the affected system with the privileges of the browser or email client process, resulting in high confidentiality, integrity, and availability impact. An attacker could leverage code execution to access sensitive user data, install malware, or use the compromised system as a pivot point for lateral movement within a network. The broad deployment of Firefox and Thunderbird across enterprise and consumer environments significantly expands the potential attack surface (Mozilla Advisory MFSA2026-15, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.024%, indicating a low current probability of exploitation in the wild. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Despite the lack of active exploitation, the critical CVSS score and network-based attack vector with no required user interaction make this a high-priority patching target.

Mozilla has released patched versions addressing CVE-2026-2793 across all affected product lines. Users should upgrade to one of the following: Firefox 148 or later, Firefox ESR 115.33 or later, Firefox ESR 140.8 or later, Thunderbird 148 or later, or Thunderbird ESR 140.8 or later. For environments where immediate patching is not feasible, Mozilla recommends restricting network access to affected applications or disabling them until updates can be applied. Updates are available through Mozilla's standard update mechanism and via vendor-specific channels (e.g., Red Hat, Debian, SUSE, Oracle Linux, Amazon Linux) (Mozilla Advisory MFSA2026-13, Mozilla Advisory MFSA2026-14, Mozilla Advisory MFSA2026-15).

The vulnerability was picked up broadly by Linux distribution security teams, with Red Hat, Debian, SUSE, Oracle Linux, Rocky Linux, AlmaLinux, Amazon Linux, and Slackware all issuing advisories and updated packages within days of Mozilla's disclosure. Tenable and Qualys both released detection plugins shortly after the advisory was published. Coverage from security-focused outlets such as CyberInsider noted the Firefox 148 release in the context of broader security improvements. No notable individual researcher commentary or significant social media debate specific to CVE-2026-2793 has been identified, consistent with the absence of active exploitation or public PoC (Feedly).