CVE-2026-0886 is a vulnerability classified under CWE-119 related to incorrect boundary conditions in the Graphics component of Mozilla Firefox. It was reported by Oskar L and is addressed in Firefox 147 and ESR versions 115.32 and 140.7, as well as Thunderbird 147 and 140.7. The CVSS v3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating a network attack vector with low complexity, no privileges or user interaction required, and limited confidentiality impact only. The Mozilla advisories confirm the vulnerability is fixed and no known exploits are reported.

The vulnerability impacts the confidentiality of information processed by the Graphics component due to incorrect boundary conditions but does not affect integrity or availability. Exploitation could potentially lead to limited information disclosure. There are no reports of active exploitation in the wild. The impact is rated moderate by Mozilla and medium severity by CVSS.

Mozilla has released official fixes for this vulnerability in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Users and administrators should update to these versions or later to remediate the issue. Since the vulnerability is fixed in these releases, no additional mitigation steps are required beyond applying the official patches.