This vulnerability (CVE-2026-2447) involves a heap buffer overflow in the libvpx library component used by Mozilla Firefox and Thunderbird. The issue was reported by jayjayjazz and is tracked under Bug 2014390. It affects Firefox versions prior to 147.0.4 and ESR versions prior to 140.7.1 and 115.32.1, and Thunderbird versions prior to 140.7.2 and 147.0.2. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. Mozilla has released official fixes in the specified versions. Thunderbird's email context generally mitigates exploitation due to disabled scripting, but browser-like contexts remain vulnerable if unpatched.

Successful exploitation of this heap buffer overflow can lead to arbitrary code execution or application crashes, impacting confidentiality, integrity, and availability of the affected software. The vulnerability is exploitable remotely over the network with low complexity and no privileges, but requires user interaction. While Thunderbird's email reading context is generally safe due to disabled scripting, other contexts that use libvpx may be at risk if unpatched.

Official fixes are available from Mozilla and should be applied immediately. Update Firefox to version 147.0.4 or later, Firefox ESR to 140.7.1 or 115.32.1 or later, and Thunderbird to 140.7.2 or 147.0.2 or later. No additional mitigation is required beyond applying these patches. Refer to Mozilla advisories MFSA 2026-10 and MFSA 2026-11 for detailed update instructions.