CVE-2026-2774 is an integer overflow vulnerability classified under CWE-190 affecting the Audio/Video component of Mozilla Firefox. The flaw could allow an attacker to cause memory corruption leading to potential arbitrary code execution or other high-impact outcomes. The vulnerability was addressed and fixed in Firefox 148 and ESR versions 115.33 and 140.8, as well as corresponding Thunderbird versions. The Mozilla Foundation security advisories MFSA 2026-13 and MFSA 2026-14 provide detailed information on this and related vulnerabilities, confirming the availability of patches.

The vulnerability has a high CVSS score of 8.8 indicating it can be exploited remotely without privileges and requires user interaction. Successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system. However, there are no known exploits in the wild at the time of publication. The impact is mitigated by the availability of official fixes.

Mozilla has released official fixes for this vulnerability in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. No additional mitigation steps are required beyond applying the official patches.