CVE-2026-2789 is a use-after-free vulnerability classified under CWE-416 affecting the Graphics: ImageLib component in Mozilla Firefox. This type of vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The issue was resolved in Firefox 148 and Firefox ESR 115.33. The Mozilla Foundation security advisories MFSA2026-13 and MFSA2026-14 provide detailed information on the fix and related vulnerabilities. The CVSS v3.1 base score is 8.8, indicating a high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this use-after-free vulnerability could lead to arbitrary code execution, information disclosure, or denial of service in affected Firefox versions prior to 148 and ESR 115.33. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability. However, no known exploits in the wild have been reported at the time of the advisory.

Official fixes for this vulnerability are available in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should update to these versions or later to remediate the vulnerability. Since this is not a cloud service, manual patching is required. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching.