CVE-2026-2797 is a use-after-free vulnerability in the JavaScript garbage collection component of Mozilla Firefox. Use-after-free (CWE-416) vulnerabilities occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption. This specific flaw affects Firefox and was fixed in version 148. The vulnerability has a CVSS 3.1 score of 8.8, reflecting its high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The Mozilla Foundation released security advisories MFSA 2026-13 and MFSA 2026-16 detailing the fix and related vulnerabilities. The advisory confirms the fix is available and that exploitation in Thunderbird is unlikely due to disabled scripting in mail reading.

Successful exploitation of this use-after-free vulnerability could allow an attacker to execute arbitrary code, cause a denial of service, or otherwise compromise the confidentiality, integrity, and availability of the affected system. The CVSS score of 8.8 indicates a high impact. However, no known exploits in the wild have been reported. In Thunderbird, the risk is mitigated by disabled scripting in email contexts, reducing the likelihood of exploitation through email vectors.

Mozilla has released official fixes for this vulnerability in Firefox 148 and Thunderbird 148. Users and administrators should update to these versions or later to remediate the issue. Since this is not a cloud service, local patching is required. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed as fixed in the stated versions.