CVE-2026-2772 is a use-after-free vulnerability (CWE-416) affecting the Audio/Video playback component in Mozilla Firefox. This memory safety bug could lead to arbitrary code execution or other severe impacts due to memory corruption. The vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Mozilla's official security advisories (MFSA 2026-13 and MFSA 2026-14) confirm the fix and classify the impact as high with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

The vulnerability allows an attacker to exploit a use-after-free condition in the Audio/Video playback component, potentially leading to arbitrary code execution or other memory corruption consequences. The CVSS score of 8.8 indicates high impact on confidentiality, integrity, and availability. Exploitation requires user interaction but no privileges or complex attack conditions.

A fix is available and has been officially released by Mozilla. Users and administrators should update Firefox to version 148 or later, or Firefox ESR to version 115.33 or later, to remediate this vulnerability. The vendor advisory confirms the issue is fixed in these versions. No additional mitigation steps are required beyond applying the official update.