CVE-2026-2759 is a critical security vulnerability identified in the Graphics: ImageLib component of Mozilla Firefox. It involves incorrect boundary conditions that could be exploited to cause high-impact security issues affecting confidentiality, integrity, and availability. The vulnerability has a CVSS v3.1 base score of 9.8, indicating critical severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Mozilla has addressed this vulnerability in Firefox 148 and Firefox ESR 115.33 and later versions, as documented in their official security advisories MFSA2026-13 and MFSA2026-14.

The vulnerability allows an attacker to potentially execute arbitrary code or cause denial of service due to improper boundary checks in the ImageLib graphics component. The CVSS score of 9.8 reflects the critical nature of the flaw, with impacts on confidentiality, integrity, and availability. Exploitation could occur remotely without authentication or user interaction. However, no known exploits were reported in the wild at the time of disclosure.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should apply these updates promptly to remediate the vulnerability. Patch status is confirmed by the vendor advisories. No additional mitigation steps are required beyond updating to the fixed versions.