CVE-2026-2806: 
NixOS vulnerability analysis and mitigation

CVE-2026-2806 is an uninitialized memory vulnerability in the Graphics: Text component of Mozilla Firefox and Thunderbird, specifically within the gfxSVGGlyphsDocument constructor in gfxSVGGlyphs.cpp. The flaw was reported by external researcher Zijie Zhao and disclosed on February 24, 2026, as part of Mozilla Foundation Security Advisories MFSA2026-13 (Firefox) and MFSA2026-16 (Thunderbird). It affects all versions of Firefox and Thunderbird prior to 148.0. Mozilla rated the impact as low in its advisories, while the NVD assigned a CVSS v3.1 base score of 9.1 (Critical) — a notable discrepancy reflecting differing assessments of exploitability (Mozilla Advisory, Mozilla Advisory).

The root cause (CWE-908: Use of Uninitialized Resource; CWE-457: Use of Uninitialized Variable) lies in the gfxSVGGlyphsDocument constructor, which reads the expected uncompressed size (origLen) from the last 4 bytes of a gzip-compressed SVG font buffer without validating it against the actual output of inflate(). The code allocates a heap buffer of size origLen and passes it to ParseDocument() even when inflate() only populates a portion of it — leaving the remainder uninitialized. A correctness assertion (MOZ_ASSERT) that would catch this mismatch is compiled out in release builds, meaning the bug is silently exploitable via a maliciously crafted web font that appends trailing bytes to a valid gzip stream to claim an inflated uncompressed size (Mozilla Bugzilla). The fix replaces use of origLen with the actual total_out value from the zlib stream, ensuring only initialized data is parsed (Mozilla Bugzilla).

Successful exploitation could cause the SVG document parser (ParseDocument()) to process large regions of uninitialized heap memory, potentially exposing sensitive data resident in adjacent heap allocations — such as credentials, session tokens, or other in-memory content — to an attacker who can observe the rendered output or trigger information leakage through side channels. There is also a potential availability impact if the uninitialized data causes the parser to crash or enter an undefined state. The vulnerability is triggerable from arbitrary web content (e.g., a malicious web font embedded in a webpage), requiring no user interaction beyond visiting a page (Mozilla Bugzilla, Mozilla Advisory).

No public proof-of-concept exploit or in-the-wild exploitation has been observed as of the time of disclosure. The reporter provided a PoC (poc.zip and poc.py) to Mozilla as part of the responsible disclosure process, but this has not been publicly released. The EPSS score is approximately 0.017% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla's internal security team rated this as sec-low, noting that while triggering uninitialized memory access is straightforward, recovering useful data from the SVG parser's output is considered challenging (Mozilla Bugzilla, Mozilla Advisory).

1. Craft a malicious SVG font file: Use a script (similar to the reporter's poc.py) to create a gzip-compressed SVG font where the last 4 bytes (the stored uncompressed size field) are set to a value much larger than the actual decompressed data, causing the browser to allocate an oversized heap buffer.
2. Embed the font in a web page: Reference the malicious font file via CSS @font-face in an HTML page, ensuring the browser's text rendering engine loads and processes the SVG font through the vulnerable gfxSVGGlyphsDocument constructor.
3. Serve the page to a target: Host the page on an attacker-controlled server and lure the victim to visit it. No user interaction beyond page load is required.
4. Trigger uninitialized memory parsing: When Firefox or Thunderbird renders text using the malicious font, gfxSVGGlyphsDocument allocates a buffer of the attacker-specified size, inflate() populates only part of it, and ParseDocument() processes the remainder as uninitialized heap data.
5. Attempt data recovery: Depending on heap layout, the uninitialized region may contain sensitive data from adjacent allocations. Recovering this data requires the SVG parser to incorporate it into observable output (e.g., rendered glyphs or error states), which Mozilla assessed as challenging but not impossible (Mozilla Bugzilla).

• Network: HTTP requests fetching unusual or unexpected font files (.woff, .woff2, .svg, .otf) from untrusted or newly registered domains; large font files with anomalous gzip trailers.
• Process: Firefox or Thunderbird processes crashing with assertion failures or memory errors related to gfxSVGGlyphs.cpp (visible in debug builds); unexpected child processes or crashes in the browser's content process.
• Logs: Crash reports referencing gfxSVGGlyphsDocument or gfxSVGGlyphs.cpp:313; assertion failure messages such as MOZ_ASSERT(size_t(s.next_out - outBuf.Elements()) == origLen) in debug/sanitizer builds.
• File System: Suspicious font files cached in the browser's profile directory with anomalous file sizes or gzip structures (Mozilla Bugzilla).

Mozilla has released patches in Firefox 148.0 and Thunderbird 148.0, which replace the use of the attacker-controlled origLen value with the actual total_out from the zlib stream, ensuring only initialized data is passed to ParseDocument(). No configuration-based workaround is available; upgrading to the patched versions is the only remediation. ESR branches (115.x and 140.x) were assessed as affected but marked wontfix by Mozilla, so users on ESR tracks should evaluate upgrading to the main release channel (Mozilla Advisory, Mozilla Advisory, Mozilla Bugzilla).

Mozilla's internal security team (Daniel Veditz, Brad Werth, Jonathan Kew) discussed the exploitability in the public Bugzilla thread, concluding that while uninitialized memory access is easily triggered, recovering meaningful data through the SVG parser is significantly harder than equivalent image decoder bugs — leading to a sec-low internal rating despite the high NVD CVSS score. The discrepancy between Mozilla's low impact rating and the NVD's 9.1 Critical score drew some attention in vulnerability tracking communities. No significant broader media coverage or notable researcher commentary beyond the Bugzilla discussion has been identified (Mozilla Bugzilla).