CVE-2026-2759 describes a security vulnerability in the Graphics: ImageLib component of Mozilla Firefox due to incorrect boundary conditions. This issue can lead to significant security impacts as indicated by its CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was fixed in Firefox 148 and Firefox ESR 115.33. The Mozilla Foundation Security Advisories MFSA 2026-13 and MFSA 2026-14 confirm the fix and classify the impact as high. No public exploit activity has been reported. The vulnerability affects versions prior to Firefox 148 and Firefox ESR 115.33.

The vulnerability allows an attacker to potentially compromise confidentiality, integrity, and availability of the affected Firefox browser due to incorrect boundary conditions in the Graphics: ImageLib component. The CVSS score of 9.8 reflects critical severity with network attack vector, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability. This could enable remote code execution or other severe consequences if exploited.

A fix is available and has been officially released by Mozilla. Users should update to Firefox 148 or later, or Firefox ESR 115.33 or later, to remediate this vulnerability. The vendor advisory explicitly states the vulnerability is fixed in these versions. No additional mitigation steps are required beyond applying the official update.