CVE-2026-2771

The vulnerability results from undefined behavior in the DOM (Document Object Model) processing engine responsible for handling core and HTML components. According to CWE-125 classification, the vulnerability may involve reading data outside the intended memory buffer. The attack vector is network (AV:N), requires no privileges (PR:N) or user interaction (UI:N), which means that simply visiting a maliciously crafted website or opening an appropriately prepared message may be sufficient to trigger the vulnerability.

An attacker can potentially obtain sensitive information from process memory, compromise data integrity, or cause loss of application availability. The full impact includes a high level of confidentiality, integrity, and availability breach (C:H/I:H/A:H).

Update immediately to Mozilla Firefox 148, Firefox ESR 115.33 or Firefox ESR 140.8, and Mozilla Thunderbird 148 or Thunderbird 140.8, in which the vulnerability has been eliminated.

Mozilla Firefox versions before 148 and Firefox ESR before 115.33 and Firefox ESR 140.8; Mozilla Thunderbird versions before 148 and Thunderbird 140.8.