Junglewise Threat Intelligence

CVE-2026-2762: Mozilla Firefox and Thunderbird integer overflow in JavaScript Standard Library

CVE-2026-2762 · Severity: critical · CVSS 9.8 · Published 2026-02-24

Technologies: Red Hat Enterprise Linux AppStream, Mozilla Thunderbird, Mozilla Firefox ESR, Mozilla Firefox. Vendors: Red Hat, Mozilla.

Executive brief

A vulnerability exists in the JavaScript engine used by Firefox and Thunderbird that could allow an attacker to execute malicious code on a user's computer. This occurs when the software processes specifically crafted text patterns, potentially leading to unauthorized access to sensitive data or a complete system takeover. Users should update their browser and email client to the latest versions to protect against this threat.

Technical details

An integer overflow vulnerability exists in the 'EncodeForRegExpEscape' function within the JavaScript: Standard Library component of Mozilla's Gecko engine. On 32-bit platforms, the output length computation for escaping regular expressions can overflow size_t when processing extremely long strings (e.g., repeating a character approximately 715 million times). This leads to an undersized buffer allocation via 'StringBuilder::reserve()', followed by a heap-based buffer overflow when the actual characters are written. An attacker can leverage this to corrupt memory in the 'js::StringBufferArena' malloc arena, potentially achieving arbitrary code execution. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, and corresponding Thunderbird releases. 64-bit builds are not affected.

Affected products

  • Mozilla Firefox < 148
  • Mozilla Firefox ESR < 140.8
  • Mozilla Thunderbird < 148, < 140.8
  • Red Hat Red Hat Enterprise Linux Server 7 ELS affected
  • Red Hat Red Hat Enterprise Linux AppStream EUS 10.0 affected

Timeline

  • 2026-02-24: advisory: Mozilla Foundation Security Advisory 2026-13 published
  • 2026-02-24: patched: Fixed in Firefox 148 and Firefox ESR 140.8

References

Related threats