CVE-2026-2788 is a memory safety vulnerability classified under CWE-119 affecting the Audio/Video GMP component of Mozilla Firefox. It involves incorrect boundary conditions that could be exploited remotely without authentication or user interaction to achieve full compromise of confidentiality, integrity, and availability. The issue was resolved in Firefox 148 and corresponding ESR and Thunderbird versions. Mozilla's security advisories MFSA 2026-13 and MFSA 2026-14 confirm the fix and list this vulnerability among several high-impact memory safety bugs patched simultaneously. The vulnerability is not related to cloud services and no active exploitation has been observed.

The vulnerability allows remote attackers to potentially execute arbitrary code or cause denial of service due to memory corruption stemming from incorrect boundary checks in the Audio/Video GMP component. The CVSS 3.1 base score of 9.8 reflects critical impact with network attack vector, no privileges or user interaction required, and full compromise of confidentiality, integrity, and availability. Successful exploitation could lead to complete control over the affected Firefox or Thunderbird application. No known active exploits have been reported, but the severity and nature of the bug indicate a high risk if unpatched.

Mozilla has released official patches fixing CVE-2026-2788 in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these updates. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as fixed by Mozilla advisories MFSA 2026-13 and MFSA 2026-14.