Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
Firefox and Thunderbird: Heap Overflow in libvpx Could Crash Browser
CVE-2026-2447
Summary
Some versions of Firefox and Thunderbird are vulnerable to a bug that could cause the browser to crash or behave unexpectedly. This issue affects users of older versions of these browsers, making them more susceptible to crashes. Users should update to the latest version to resolve the issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| mozilla | firefox | <= 115.32.1 | – |
| mozilla | firefox | <= 147.0.4 | – |
| mozilla | firefox | > 116.0 , <= 140.7.1 | – |
| mozilla | thunderbird | <= 140.7.2 | – |
| mozilla | thunderbird | > 141.0 , <= 147.0.2 | – |
Original title
Heap buffer overflow in libvpx. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, Firefox ESR < 115.32.1, Thunderbird < 140.7.2, and Thunderbird < 147.0.2.
Original description
Heap buffer overflow in libvpx. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, Firefox ESR < 115.32.1, Thunderbird < 140.7.2, and Thunderbird < 147.0.2.
nvd CVSS3.1
8.8
Vulnerability type
CWE-122
Heap-based Buffer Overflow
- https://bugzilla.mozilla.org/show_bug.cgi?id=2014390 Issue Tracking Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-10/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-11/ Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2026/02/msg00028.html
Published: 16 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026