CVE-2026-2447

HighCVSS 8.8

Published: 16/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

45th percentile - higher than 45% of all known CVEs

Summary

A heap buffer overflow was found in the libvpx library. This vulnerability was patched in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

Risk Assessment

An attacker could remotely cause an application crash or potentially execute arbitrary code in the user's context, leading to system compromise.

Recommendation

Immediately update Firefox to version 147.0.4, Firefox ESR to 140.7.1 or 115.32.1, and Thunderbird to 140.7.2 or 147.0.2.

Other vulnerabilities in libvpx

CVE-2023-5217HighActively exploited
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Original NVD description (English source)

Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.