CVE-2026-0882 is a use-after-free vulnerability classified under CWE-416 affecting the IPC component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential memory corruption leading to high-impact consequences including arbitrary code execution and denial of service. It was fixed by Mozilla in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. The CVSS v3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory confirms the fix and recommends updating to the patched versions.

The vulnerability can lead to arbitrary code execution and denial of service due to memory corruption in the IPC component. This impacts confidentiality, integrity, and availability of the affected products. No known exploits are reported in the wild, but the high CVSS score indicates serious potential impact if exploited.

Mozilla has released official fixes for this vulnerability in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation actions are required beyond applying the official patches.