CVE-2026-2447 is a heap buffer overflow vulnerability in the libvpx library component used by Mozilla Firefox and Thunderbird. The vulnerability allows for potential memory corruption leading to high impact on confidentiality, integrity, and availability. Mozilla fixed this issue in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2. The advisory notes that exploitation via Thunderbird email is generally not feasible due to disabled scripting, but browser or browser-like contexts remain vulnerable. No known exploits have been observed in the wild. The CVSS v3.1 base score is 8.8, indicating a high severity level.

Successful exploitation of this heap buffer overflow could result in complete compromise of confidentiality, integrity, and availability of the affected application. This could allow an attacker to execute arbitrary code or cause denial of service. However, no known exploits in the wild have been reported. The impact is rated high by Mozilla and reflected in the CVSS score of 8.8.

Mozilla has released official patches fixing this vulnerability in Firefox versions 147.0.4, ESR 140.7.1, and ESR 115.32.1, and Thunderbird versions 140.7.2 and 147.0.2. Users should update to these versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these updates. No additional mitigation steps are indicated by the vendor advisory.