PT-2026-2648 · Mozilla+4 · Firefox Esr+5

Oskar L · Published 2026-01-13 · Updated 2026-03-18 · CVE-2026-0886

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 147 Firefox ESR versions prior to 115.32 Firefox ESR versions prior to 140.7

Description The Graphics component contains incorrect boundary conditions. This could lead to potential remote code execution.

Recommendations Update Firefox to a version later than 146. Update Firefox ESR to a version later than 115.31. Update Firefox ESR to a version later than 140.6.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-501

Related Identifiers

ALSA-2026:0667

ALSA-2026:0694

ALSA-2026:0924

ALSA-2026:2220

ALSA-2026:2271

ALSA-2026:2286

BDU:2026-03388

CVE-2026-0886

MGASA-2026-0013

MGASA-2026-0014

OESA-2026-1085

OESA-2026-1086

OESA-2026-1087

OESA-2026-1088

OESA-2026-1089

OESA-2026-1090

OESA-2026-1264

OESA-2026-1285

OPENSUSE-SU-2026:10037-1

OPENSUSE-SU-2026:10046-1

OPENSUSE-SU-2026:10058-1

OPENSUSE-SU-2026:20041-1

OPENSUSE-SU-2026:20391-1

RHSA-2026:0667

RHSA-2026:0694

RHSA-2026:0924

RHSA-2026:1320

RHSA-2026:1413

RHSA-2026:1414

RHSA-2026:1415

RHSA-2026:1461

RHSA-2026:1462

RHSA-2026:1471

RHSA-2026:1487

RHSA-2026:2041

RHSA-2026:2043

RHSA-2026:2044

RHSA-2026:2047

RHSA-2026:2069

RHSA-2026:2070

RHSA-2026:2073

RHSA-2026:2074

RHSA-2026:2220

RHSA-2026:2231

RHSA-2026:2271

RHSA-2026:2286

SUSE-SU-2026:0122-1

SUSE-SU-2026:0153-1

SUSE-SU-2026:0260-1

SUSE-SU-2026:20086-1

USN-7991-1

Affected Products

Firefox

Firefox Esr

Linuxmint

Red Os

Rocky Linux

Ubuntu

References · 319

• https://ubuntu.com/security/CVE-2025-9184 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6427 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6433 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-9180 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-11715 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0241 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13019 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0818 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13013 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0886 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-0237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13014 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-6435 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0122-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:2220 · Vendor Advisory