CVE-2026-2774

CriticalCVSS 9.8

Published: 24/02/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

42th percentile - higher than 42% of all known CVEs

Summary

An integer overflow was found in the Audio/Video component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Risk Assessment

An integer overflow could lead to unexpected behavior, potentially enabling remote code execution or application crash, threatening system confidentiality and availability.

Recommendation

Immediately update Firefox to version 148 or later (or appropriate ESR version) and Thunderbird to version 148 or 140.8.

Original NVD description (English source)

Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.