CVE-2026-2757

The vulnerability results from improper handling of boundary conditions in the component responsible for processing audio and video in the WebRTC protocol. An attacker can provide specially crafted media data over the network, leading to memory integrity violation or other improper application behavior. Due to the lack of detailed technical information (CWE: NVD-CWE-noinfo), the exact exploitation mechanism is not publicly documented.

Successful exploitation of this vulnerability may allow an attacker to obtain sensitive data, compromise system integrity, or cause application unavailability — with the highest level of impact on confidentiality, integrity, and availability according to the CVSS vector.

Software should be updated to the following versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8, in accordance with the manufacturer's recommendations published in Mozilla security advisories (MFSA2026-13 through MFSA2026-16).

Mozilla Firefox prior to version 148, Mozilla Firefox ESR prior to versions 115.33 and 140.8, Mozilla Thunderbird prior to version 148, and Mozilla Thunderbird prior to version 140.8.