Junglewise Threat Intelligence

CVE-2026-2447: WebM Project libvpx heap buffer overflow in VP8/VP9 codec

CVE-2026-2447 · Severity: high · CVSS 8.8 · Published 2026-02-16

Technologies: Mozilla Thunderbird, Mozilla Firefox ESR, Mozilla Firefox. Vendors: Mozilla, Debian.

Executive brief

A vulnerability was found in libvpx, a widely used library for processing VP8 and VP9 video formats. In products like Firefox and Thunderbird, this flaw could allow an attacker to cause a program crash or potentially take control of a user's system if they are tricked into viewing specially crafted video content. This issue primarily impacts the stability of the application and the security of user data during media playback.

Technical details

A heap-based buffer overflow exists in libvpx, specifically within the handling of VP8/VP9 video streams. The root cause appears to be an insufficient bounds check in the 'write_superframe_index' function and related components when the buffer is full. An attacker can exploit this by providing a malformed video file or stream that triggers an out-of-bounds write. While the attack vector is network-based, it typically requires user interaction, such as visiting a malicious website or opening a crafted media file. Successful exploitation can lead to a denial of service (crash) or arbitrary code execution within the context of the application. Fixes have been released in libvpx 1.16.0 and corresponding downstream updates for Mozilla products and Debian.

Affected products

  • Mozilla Firefox < 147.0.4
  • Mozilla Firefox ESR < 140.7.1, < 115.32.1
  • Mozilla Thunderbird < 140.7.2, < 147.0.2
  • WebM Project libvpx < 1.16.0
  • Debian libvpx 1.9.0-1+deb11u5

Timeline

  • 2026-02-16: advisory: Mozilla Foundation Security Advisory published
  • 2026-02-16: patched: Fixed in Firefox 147.0.4 and Thunderbird 147.0.2
  • 2026-02-22: advisory: Debian LTS Advisory DLA-4489-1 published

References

Related threats