CVE-2026-2759

The error lies in improper verification of boundary conditions in the ImageLib library responsible for graphics processing. Incorrect boundary handling can lead to memory operations outside the permitted range when processing specially crafted image files or graphic content. A network attack vector (AV:N) without authentication requirements (PR:N) and user interaction (UI:N) means that simply visiting a malicious website or opening a crafted message may be sufficient to trigger the vulnerability.

Successful exploitation of this vulnerability may enable an attacker to gain full control over the confidentiality, integrity, and availability of the system — which corresponds to a High rating in all three CVSS categories. In practice, this may result in remote code execution (RCE) in the context of a browser or mail client process.

Software must be updated immediately to the following patched versions: Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, or Thunderbird 140.8. Patches are available through Mozilla's automatic update mechanism and on official product websites.

Mozilla Firefox versions prior to 148 and Firefox ESR versions prior to 115.33 and 140.8, as well as Mozilla Thunderbird versions prior to 148 and Thunderbird 140.8.