CVE-2026-2793 encompasses a set of memory safety bugs affecting Mozilla Firefox ESR 115.32, ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. The vulnerabilities include use-after-free, integer overflow, sandbox escapes, and other memory corruption issues across various components such as JavaScript engine, graphics, audio/video, DOM, and networking. These bugs could potentially allow remote attackers to execute arbitrary code without user interaction. Mozilla released official fixes in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. The CVSS v3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical impact on confidentiality, integrity, and availability.

Successful exploitation of these memory safety vulnerabilities could lead to arbitrary code execution, complete compromise of the affected browser or email client, and potential sandbox escapes. This poses a critical risk to user security and privacy. However, no active exploitation in the wild has been reported as of the advisory date.

Mozilla has released official patches addressing these vulnerabilities in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Users and administrators should promptly update to these fixed versions to mitigate the risk. No additional mitigations or workarounds are indicated by the vendor advisory.