CVE-2026-2774 describes an integer overflow vulnerability in the Audio/Video component of Mozilla Firefox. Integer overflow can cause unexpected behavior such as memory corruption, which may be exploited to compromise the application. Mozilla fixed this vulnerability in Firefox 148 and Firefox ESR 115.33, along with Thunderbird 148 and 140.8. The vulnerability has a CVSS 3.1 base score of 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. The vendor advisory confirms the fix and lists this vulnerability among multiple high-impact security issues addressed in the same release cycle.

Successful exploitation of this integer overflow vulnerability could allow an attacker to cause significant impact including full compromise of confidentiality, integrity, and availability of the affected Firefox or Thunderbird application. The CVSS score of 8.8 reflects a high severity risk. However, there are no known exploits in the wild at the time of the advisory.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these fixed versions or later to remediate this vulnerability. No additional mitigation is required beyond applying the official updates.