Executive brief
A vulnerability exists in the image processing component of Mozilla Firefox and Thunderbird. This flaw allows the software to read data outside of its intended memory boundaries when processing specially crafted AVIF images. In practice, this could lead to application crashes or potentially allow an attacker to access sensitive information or execute unauthorized code on a user's system.
Technical details
An out-of-bounds read vulnerability exists in the AVIFDecoderStream::ReadAt function within Mozilla's ImageLib component. The root cause is a lack of validation for the 'offset' parameter; when a negative or excessively large offset is provided, an integer underflow occurs during the calculation of the remaining buffer length. This results in a large 'size' value being passed to a memcpy operation, which then reads past the end of the allocated buffer. The vulnerability can be triggered by untrusted AVIF input. Patches have been released for Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, and corresponding versions of Thunderbird.
Affected products
- Mozilla Firefox < 148
- Mozilla Firefox ESR < 115.33, < 140.8
- Mozilla Thunderbird < 148, < 140.8
Timeline
- 2026-02-24: advisory: Mozilla Foundation Security Advisory published
- 2026-02-24: patched
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2010933
- https://www.mozilla.org/security/advisories/mfsa2026-13/
- https://www.mozilla.org/security/advisories/mfsa2026-14/
- https://www.mozilla.org/security/advisories/mfsa2026-15/
- https://www.mozilla.org/security/advisories/mfsa2026-16/
- https://www.mozilla.org/security/advisories/mfsa2026-17/
- https://access.redhat.com/errata/RHSA-2026:3338