CVE-2026-2806
Uninitialized memory in the Graphics: Text component
9.1 Critical
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
0.45%Up 0.4 points since Feb 25, 2026
What each source reports
NVD Score used
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
- Record
CVE-2026-2806- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-908, CWE-457
- Updated
- 2026-11-02
CVE List
Uninitialized memory in the Graphics: Text component
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
- Record
CVE-2026-2806- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-457
- Updated
- 2026-11-02
EUVDEUVD-2026-8459
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
- Record
EUVD-2026-8459- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hwjj-g6g7-p8cf
Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox < 148.
Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox < 148.
- Record
GHSA-hwjj-g6g7-p8cf- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-457, CWE-908
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-2806
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
- Record
UBUNTU-CVE-2026-2806- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1783970136No score
thunderbird: Fix of 10 CVEs
- CVE-2024-7519: fix out-of-bounds write in graphics ShmemSection handling (Mozilla bug 1902307)
- CVE-2025-14324: fix constant-pool assembler-buffer size miscalculation on ARM (Mozilla bug 1996840)
- CVE-2026-2806: fix SVG glyph out-of-bounds read via decompression size mismatch (Mozilla bug 2006199)
- Record
CLSA-2026-1783970136- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10257-1No score
MozillaFirefox-148.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-148.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10257-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11373-1No score
firefox-esr-153.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11373-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdTuxCare:AlmaLinux:9.2 From an advisory covering 3 CVEs | before 115.4.1-1.el9_2.alma.tuxcare.els23 | 115.4.1-1.el9_2.alma.tuxcare.els23 |
mozjs52Ubuntu:18.04:LTS | All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 | None known |
mozjs38Ubuntu:18.04:LTS | All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 | None known |
mozjs68Ubuntu:20.04:LTS | All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 | None known |
mozjs52Ubuntu:20.04:LTS | All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 | None known |
mozjs102Ubuntu:22.04:LTS | All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 | None known |
mozjs78Ubuntu:22.04:LTS | All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 | None known |
mozjs91Ubuntu:22.04:LTS | All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 | None known |
thunderbirdUbuntu:22.04:LTS | All versions, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 34 moreShow less1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1 | None known |
mozjs102Ubuntu:24.04:LTS | All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2 | None known |
mozjs115Ubuntu:24.04:LTS | All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1 | None known |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 51 CVEs | before 148.0-1.1 | 148.0-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 228 CVEs | before 153.0-1.1 | 153.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-2806 is a critical vulnerability (CVSS 9.1) in Mozilla Firefox, published February 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=2006199
mozilla.org/security/advisories/mfsa2026-13
nvd.nist.gov/vuln/detail/CVE-2026-2806
github.com/advisories/GHSA-hwjj-g6g7-p8cf
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1783970136.html
Show 194 moreShow less
ubuntu.com/security/CVE-2026-2806
cve.org/CVERecord?id=CVE-2026-2806
suse.com/security/cve/CVE-2026-2757
This page doesn't list everything
Left out here: 83 references. The JSON record has them.