CVE-2026-2762: Mozilla Firefox and Thunderbird integer overflow in JavaScript Standard Library

CVE-2026-2762 · Severity: critical · CVSS 9.8 · Published 2026-02-24

A vulnerability exists in the JavaScript engine used by Firefox and Thunderbird that could allow an attacker to execute malicious code on a user's computer. This occurs when the software processes specifically crafted text patterns, potentially leading to unauthorized access to sensitive data or a complete system takeover. Users should update their browser and email client to the latest versions to protect against this threat.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Red Hat Enterprise Linux AppStream. Vendors: Mozilla, Red Hat.

Quick answers

Is CVE-2026-2762 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2762 being exploited in the wild.
How severe is CVE-2026-2762?
Critical severity, with a CVSS score of 9.8, published 24 February 2026.
Which products and versions are affected?
Mozilla Firefox < 148; Mozilla Firefox ESR < 140.8; Mozilla Thunderbird < 148, < 140.8; Red Hat Enterprise Linux AppStream affected.
Is there a fix for CVE-2026-2762?
A patch was published on 2026-02-24: Fixed in Firefox 148 and Firefox ESR 140.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2762 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-2762?
Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the 'EncodeForRegExpEscape' function within the JavaScript: Standard Library component of Mozilla's Gecko engine. On 32-bit platforms, the output length computation for escaping regular expressions can overflow size_t when processing extremely long strings (e.g., repeating a character approximately 715 million times). This leads to an undersized buffer allocation via 'StringBuilder::reserve()', followed by a heap-based buffer overflow when the actual characters are written. An attacker can leverage this to corrupt memory in the 'js::StringBufferArena' malloc arena, potentially achieving arbitrary code execution. The vulnerability is fixed in Firefox 148, Firefox ESR 140.8, and corresponding Thunderbird releases. 64-bit builds are not affected.

Affected products

  • Mozilla Firefox < 148
  • Mozilla Firefox ESR < 140.8
  • Mozilla Thunderbird < 148, < 140.8
  • Red Hat Red Hat Enterprise Linux Server 7 ELS affected
  • Red Hat Red Hat Enterprise Linux AppStream EUS 10.0 affected

Timeline

  • 2026-02-24: advisory: Mozilla Foundation Security Advisory 2026-13 published
  • 2026-02-24: patched: Fixed in Firefox 148 and Firefox ESR 140.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.