CVE-2026-0880 is a sandbox escape vulnerability due to an integer overflow in the Graphics component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox 147 and corresponding ESR and Thunderbird versions. The issue could allow an attacker to escape the sandbox environment, potentially leading to arbitrary code execution or other high-impact consequences. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, leading to full compromise of the affected application process. This could result in arbitrary code execution with the privileges of the user running Firefox, causing high impact on confidentiality, integrity, and availability of the system.

This vulnerability has been fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should update to these versions or later to remediate the vulnerability. Patch status is confirmed by Mozilla advisories. No additional mitigation steps are required beyond applying the official updates.