Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade libvpx-develUpgrade firefox-x11Upgrade libvpx | Feb 27, 2026 | Feb 25, 2026 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade firefox | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade firefoxUpgrade firefox-debuginfoUpgrade firefox-debugsource | Mar 9, 2026 | Feb 16, 2026 |
| Debian | — | Upgrade libvpxUpgrade firefox-esrUpgrade thunderbird | Feb 23, 2026 | Feb 23, 2026 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefoxUpgrade firefox-esr | Feb 23, 2026 | Feb 20, 2026 |
| Mfsa2026 10 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 147.0.4Upgrade to Mozilla Firefox ESR version 140.7.1Upgrade to Mozilla Firefox ESR version 115.32.1 | Feb 17, 2026 | Feb 16, 2026 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 140.7.2Upgrade to Mozilla Thunderbird version 147.0.2Upgrade to the latest version of Mozilla Thunderbird | Feb 17, 2026 | Feb 16, 2026 |
| Oracle_linux | — | Upgrade libvpx-develUpgrade libvpxUpgrade thunderbirdUpgrade libvpx-utilsUpgrade firefoxUpgrade firefox-x11 | Feb 27, 2026 | Feb 16, 2026 |
| Redhat_linux | — | Upgrade firefox-debuginfoUpgrade firefox-x11Upgrade libvpxUpgrade thunderbird-debuginfoUpgrade libvpx-debugsourceUpgrade libvpx-utils-debuginfoUpgrade firefoxUpgrade firefox-debugsourceUpgrade libvpx-debuginfoUpgrade thunderbird-debugsourceUpgrade libvpx-develNo solution existsUpgrade thunderbirdUpgrade libvpx-utils | Feb 26, 2026 | Feb 16, 2026 |
| Rocky_linux | — | Upgrade libvpxUpgrade libvpx-develUpgrade firefox-debugsourceUpgrade libvpx-debuginfoUpgrade firefoxUpgrade firefox-x11Upgrade firefox-debuginfoUpgrade thunderbird-debugsourceUpgrade thunderbirdUpgrade libvpx-debugsourceUpgrade thunderbird-debuginfo | Mar 2, 2026 | Feb 26, 2026 |
| Suse | — | Upgrade MozillaThunderbird-openpgp-librnpUpgrade MozillaFirefoxUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-otherUpgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-other | Feb 23, 2026 | Feb 23, 2026 |
| Ubuntu | — | Upgrade libvpx7Upgrade libvpx9 | Feb 20, 2026 | Feb 16, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub