CVE-2026-0882 is a use-after-free vulnerability in the inter-process communication (IPC) component of Mozilla Firefox and Thunderbird. This memory safety issue could allow an attacker to execute arbitrary code or cause a denial of service by exploiting the use-after-free condition. The vulnerability was addressed and fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability all rated high. Multiple vendor advisories from Mozilla and Red Hat provide official patches and errata for this vulnerability.

Successful exploitation of this use-after-free vulnerability could lead to arbitrary code execution, allowing attackers to compromise the confidentiality, integrity, and availability of affected systems running vulnerable versions of Firefox or Thunderbird. The vulnerability is rated high severity with a CVSS score of 8.8. There are no known exploits in the wild currently reported.

This vulnerability has been officially fixed by Mozilla. Users and administrators should upgrade affected products to Firefox 147 or later, Firefox ESR 115.32 or later, Firefox ESR 140.7 or later, Thunderbird 147 or later, or Thunderbird 140.7 or later. Vendor advisories from Mozilla and Red Hat provide patches and errata for these versions. Applying these official updates fully mitigates the vulnerability.