CVE-2026-2792: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 148 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.8 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 148 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 140.8 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 148 - Upgrade
Upgrade
Mozilla Thunderbird ESRto a version that resolves this vulnerability.Fixed in 140.8
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-2757
- CVE-2026-2794
- CVE-2026-2758
- CVE-2026-2759
- CVE-2026-2795
- CVE-2026-2760
- CVE-2026-2761
- CVE-2026-2762
- CVE-2026-2763
- CVE-2026-2764
- CVE-2026-2796
- CVE-2026-2797
- CVE-2026-2765
- CVE-2026-2766
- CVE-2026-2767
- CVE-2026-2768
- CVE-2026-2798
- CVE-2026-2769
- CVE-2026-2799
- CVE-2026-2770
- CVE-2026-2771
- CVE-2026-2772
- CVE-2026-2773
- CVE-2026-2774
- CVE-2026-2775
- CVE-2026-2776
- CVE-2026-2777
- CVE-2026-2778
- CVE-2026-2779
- CVE-2026-2800
- CVE-2026-2780
- CVE-2026-2781
- CVE-2026-2801
- CVE-2026-2782
- CVE-2026-2783
- CVE-2026-2802
- CVE-2026-2803
- CVE-2026-2784
- CVE-2026-2785
- CVE-2026-2804
- CVE-2026-2786
- CVE-2026-2805
- CVE-2026-2787
- CVE-2026-2788
- CVE-2026-2789
- CVE-2026-2806
- CVE-2026-2790
- CVE-2026-2791
- CVE-2026-2807
- CVE-2026-2792
- CVE-2026-2793
Frequently Asked Questions
What is the severity of CVE-2026-2792?
CVE-2026-2792 has a critical severity rating of 9.8 according to the CVSS 3.1 standard.
How do I fix CVE-2026-2792?
To resolve CVE-2026-2792, users should update to Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148, or Thunderbird 148.
What systems are affected by CVE-2026-2792?
CVE-2026-2792 affects Mozilla Firefox, Mozilla Firefox Extended Support Release (ESR), and Mozilla Thunderbird.
What types of vulnerabilities does CVE-2026-2792 include?
CVE-2026-2792 includes memory safety bugs that could potentially lead to memory corruption and arbitrary code execution.
When was CVE-2026-2792 published?
CVE-2026-2792 was published on February 24, 2026.