This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Mozilla Firefox, Firefox ESR and Thunderbird fix 1 vulnerability

Mozilla fixes a high-severity vulnerability in its products [1][2]. Fixed versions: Firefox - 147.0.4 [1] Firefox ESR - 140.7.1, 115.32.1 [1] Thunderbird - 147.0.2, 140.7.2 [2] Among operating systems, the vulnerability has been fixed, for example, by Debian [3] and Ubuntu [4] in the libvpx package. Debian releases and fixed versions: bullseye - 1.9.0-1+deb11u5, bookworm - 1.12.0-1+deb12u5 trixie - 1.15.0-2.1+deb13u1 Ubuntu releases and fixed versions: questing - 1.15.0-2.1ubuntu0.1 noble - 1.14.0-1ubuntu2.3 jammy - 1.11.0-2ubuntu2.5

Mozilla Firefox, Firefox ESR, Thunderbird - RCE, DoS (CVE-2026-2447)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker to execute code or carry out a DoS attack under certain conditions using specially crafted content, due to a buffer overflow in the libvpx library for handling the VP8 and VP9 video codecs [1][2][5].

The vulnerability is present in products:

  • Firefox; <147.0.4;
  • Firefox ESR; <115.32.1; >=140, <140.7.1;
  • Thunderbird; <140.7.2; >=147, <147.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 16. 2. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 24. 2. 2026.

CESNET, z.s.p.o. Logo