CVE-2026-2771 is a critical memory safety vulnerability classified under CWE-125 (out-of-bounds read/write) affecting the DOM: Core & HTML component of Mozilla Firefox. It causes undefined behavior that could lead to severe impacts including arbitrary code execution. The vulnerability was reported by multiple researchers and fixed in Firefox 148 and ESR versions 115.33 and 140.8, as well as Thunderbird equivalents. The Mozilla advisories MFSA 2026-13 and MFSA 2026-14 confirm the fix and categorize the impact as high. This vulnerability is part of a broader set of memory safety bugs addressed simultaneously.

The vulnerability has a CVSS 3.1 base score of 9.8, reflecting critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. Exploitation could lead to arbitrary code execution or other severe consequences. No known exploits in the wild have been reported at the time of disclosure. The vulnerability affects Firefox and Thunderbird products prior to the fixed versions.

Official fixes are available and have been released by Mozilla in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying these patches. There is no indication from the vendor advisory that any additional mitigation or temporary workaround is required.