CVE-2026-2757
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in the WebRTC: Audio/Video component of Firefox and Thunderbird due to incorrect boundary conditions. The flaw is fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service, compromising system confidentiality and availability.
Recommendation
Immediately update Firefox and Thunderbird to the patched versions: Firefox 148, ESR 115.33/140.8, Thunderbird 148/140.8.
Other vulnerabilities in WebRTC
See all- CVE-2026-8094Critical
An unspecified vulnerability was found in the WebRTC component of Firefox and Thunderbird. The flaw was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.
- CVE-2026-6753High
Incorrect boundary conditions were found in the WebRTC component of Firefox and Thunderbird, potentially leading to unexpected behavior. The vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CVE-2026-6752High
A vulnerability in the WebRTC component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
- CVE-2026-6747High
A use-after-free vulnerability was found in the WebRTC component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Original NVD description (English source)
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS