CVE-2026-2774: mozilla firefox Integer Overflow or Wraparound
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2026-2774DEBIAN-CVE-2026-2774CGA-h4rj-xpmx-27x9CGA-qh86-6cgg-jj7jCGA-353j-665p-9m33CGA-rcv7-fcm2-7wjm
Published 24-02-2026Last modified 15-07-2026
Vulnerability summary
CVE-2026-2774 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in mozilla firefox. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.5% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.71%
0%100%
Low · +0.16 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 39 · Related 9DLA-4495-1DLA-4496-1DSA-6148-1DSA-6152-1MGASA-2026-0052MGASA-2026-0053OPENSUSE-SU-2026:10242-1OPENSUSE-SU-2026:10248-1OPENSUSE-SU-2026:10257-1OPENSUSE-SU-2026:20365-1OPENSUSE-SU-2026:20391-1RHSA-2026:3338RHSA-2026:3339RHSA-2026:3361RHSA-2026:3491RHSA-2026:3492RHSA-2026:3493RHSA-2026:3494RHSA-2026:3495RHSA-2026:3496RHSA-2026:3497RHSA-2026:3515RHSA-2026:3516RHSA-2026:3517RHSA-2026:3976RHSA-2026:3978RHSA-2026:3979RHSA-2026:3980RHSA-2026:3981RHSA-2026:3982RHSA-2026:3983RHSA-2026:3984RHSA-2026:4022RHSA-2026:4152RHSA-2026:4260RHSA-2026:4432SUSE-SU-2026:0812-1SUSE-SU-2026:0871-1SUSE-SU-2026:0880-1CGA-8WPH-JCR7-MQXC
Timeline
- 24-02-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVSS metrics
6 scores · 6 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources6 sources · 7.5–9.8
- CVE.orgCNA8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.16 pp
From 0.54% on 20-09-2026
20-09-202620-10-2026
EPSS score0.71%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu8 products
- mozjs102All versions (No fix recorded)
- mozjs115All versions (No fix recorded)
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
Chainguard2 products
- firefox< 140.8.0-r0
- firefox-esr< 140.8.0-r0
Debian2 products
- firefox-esr< 140.8.0esr-1~deb12u1 | < 140.8.0esr-1~deb13u1 | < 140.8.0esr-1
- thunderbird< 1:140.8.0esr-1~deb12u1 | < 1:140.8.0esr-1~deb13u1 | < 1:140.8.0esr-1
Mozilla2 products
- firefox< 115.33.0 | < 148.0 | ≥ 128.0, < 140.8.0
- thunderbird< 140.8.0 | < 148.0
Wolfi1 product
- firefox< 140.8.0-r0
5 vendors · 15 products
