CVE-2026-2758 is a use-after-free vulnerability in the JavaScript garbage collection (GC) component of Mozilla Firefox. This type of vulnerability occurs when the program continues to use memory after it has been freed, potentially leading to memory corruption and arbitrary code execution. The vulnerability was reported by Gary Kwong and is tracked under Bug 2009608. It affects Firefox versions before 148 and Firefox ESR versions before 115.33 and 140.8. Mozilla has released official fixes in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The CVSS v3.1 base score is 9.8, reflecting critical impact with high confidentiality, integrity, and availability impacts. No known exploits have been observed in the wild, but the severity and nature of the bug indicate a high risk if exploited.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code within the context of the affected application, potentially leading to full compromise of the user's environment. The CVSS score of 9.8 indicates critical impact with high confidentiality, integrity, and availability consequences. The vulnerability can be exploited remotely without privileges or user interaction.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. There are no known exploits in the wild, but applying the official patches is strongly recommended to prevent potential exploitation.