CVE-2026-2773 is a memory safety vulnerability classified under CWE-119 involving incorrect boundary conditions in the Web Audio component of Mozilla Firefox. It has a CVSS 3.1 base score of 9.8 (critical), indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability at the highest level. The issue was addressed and fixed in Firefox 148 and Firefox ESR 115.33 releases. The Mozilla Foundation Security Advisory 2026-13 and 2026-14 provide detailed information on this and related vulnerabilities, confirming the fix and high impact severity.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely without any user interaction or privileges, potentially leading to full system compromise. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported as of the advisory date.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisory.