CVE-2026-2757Disclosure(mozilla / firefox)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mozilla firefox systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

mozilla CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-1384

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

firefox
thunderbird

Threat summary

Patch or workaround signal is available
8 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 7 signals
Disclosure: 7 classified signals
Peaked 3d ago at 3 mentions (2026-02-28); latest day: 1
8 total mentions across 6 days

Affected systems

Vendors

mozilla

Products

firefoxthunderbird

Deep dive

Activity timeline8 mentions / 6d

Signal classification2 categories

Disclosure

787.5%

Patch

112.5%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	1	Disclosure1
2026-02-27	1	Disclosure1
2026-02-28	3	Disclosure3
2026-03-01	1	Disclosure1
2026-03-06	1	Disclosure1
2026-03-12	1	Patch1

Full discourse8 posts

Stanislav Fort@stanislavfort218d
Disclosure
4th (!!) high-severity (!!!) vulnerability in Firefox discovered by @Aisle_Inc 's autonomous AI system in the last few months. CVE-2026-2757: heap overflow in WebRTC H.264 decoding, attacker-controlled out-of-bounds read/write. Patched in Firefox 148. https://t.co/6Lsp9UF0ME
Post summary
The tweet announces a high‑severity heap overflow (CVE‑2026‑2757) in Firefox’s WebRTC H.264 decoder, noting the vulnerability type and that Firefox 148 patches it.
110083367.2K
15.2K followersView on X
Joshua Rogers@MegaManSec227d
Disclosure
https://aisle.com/blog/firefox-webrtc-gmp-h264-heap-overflow-via-short-encodedimage-cve-2026-2757 Firefox WebRTC GMP H.264 heap overflow via short EncodedImage (CVE-2026-2757)
Post summary
A new heap overflow vulnerability (CVE-2026-2757) in Firefox's WebRTC H.264 component has been disclosed, but no PoC, exploit, or patch details are provided.
111040423.5K
772 followersView on X
CVE@CVEnew224d
Disclosure
CVE-2026-2757 Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8. https://www.cve.org/CVERecord?id=CVE-2026-2757
Post summary
A new CVE (CVE-2026-2757) affecting Firefox versions due to incorrect boundary conditions in WebRTC's audio/video component has been disclosed, with affected version ranges specified.
01000996
56.6K followersView on X
CERT-PY@CERTpy225d
Disclosure
⚠️ Vulnerabilidades en productos Mozilla ❗ CVE-2026-2759 ❗ CVE-2026-2758 ❗ CVE-2026-2757 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-mozilla-8/ https://t.co/7PsTRT1nPC
Post summary
Three new CVEs (CVE-2026-2759, CVE-2026-2758, CVE-2026-2757) affecting Mozilla products are announced, with links provided for more information.
00001106
6.6K followersView on X
ThreatCluster@threatcluster212d
Patch
Mozilla Firefox ESR 140.8.0 for SUSE and openSUSE fixes multiple flaws, including CVE-2026-2757 and sandbox escape CVE-2026-2760 in WebRTC and Graphics components. Patch promptly. #Firefox https://threatcluster.io/cluster/critical-security-update-for-mozilla-firefox-addresses-multi-bedaf5d9
Post summary
Mozilla Firefox ESR 140.8.0 for SUSE and openSUSE includes a patch for CVE-2026-2757 and CVE-2026-2760, addressing sandbox escape in WebRTC and Graphics components.
0000066
100 followersView on X
CRAC Learning - Tech@cracbot223d
Disclosure
CVE-2026-2757 (CVSS:9.8, CRITICAL) is Modified. Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ES..https://nvd.nist.gov/vuln/detail/CVE-2026-2757 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-2757, a critical WebRTC boundary condition flaw affecting Firefox versions below 148, with CVSS 9.8, but provides no PoC, exploit, or patch details.
0000028
173 followersView on X
Infoflowcloud@infoflowcloud224d
Disclosure
🚨*CVE* CVE-2026-2757 Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8. https://www.cve.org/CVERecord?id=CVE-2026-2757 ----- Traducción: CVE-2026-2757 Condiciones de lí… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑2757, a boundary‑condition flaw in Firefox’s WebRTC audio/video component, affecting versions below 148 and certain ESR releases.
0000046
55 followersView on X
CRAC Learning - Tech@cracbot224d
Disclosure
CVE-2026-2757 (CVSS:9.8, CRITICAL) is Modified. Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ES..https://nvd.nist.gov/vuln/detail/CVE-2026-2757 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post shares basic information about CVE‑2026‑2757, its severity rating, affected Firefox versions, and a link to the NVD entry, but does not include PoC, exploit details, or patch information.
0000037
173 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mozilla	firefox	-	-	-
App	mozilla	firefox	-	-	-
App	mozilla	thunderbird	-	-	-
App	mozilla	thunderbird	-	-	-

Explore more

Back to dashboard mozilla CVEs firefox vulnerabilities

What researchers are saying

CVE-2026-2757

Stanislav Fort[verified]@stanislavfortDisclosure

The tweet announces a high‑severity heap overflow (CVE‑2026‑2757) in Firefox’s WebRTC H.264 decoder, noting the vulnerability type and that Firefox 148 patches it.

ThreatCluster[verified]@threatclusterPatch

Mozilla Firefox ESR 140.8.0 for SUSE and openSUSE includes a patch for CVE-2026-2757 and CVE-2026-2760, addressing sandbox escape in WebRTC and Graphics components.

Joshua Rogers@MegaManSecDisclosure

A new heap overflow vulnerability (CVE-2026-2757) in Firefox's WebRTC H.264 component has been disclosed, but no PoC, exploit, or patch details are provided.

CVE@CVEnewDisclosure

A new CVE (CVE-2026-2757) affecting Firefox versions due to incorrect boundary conditions in WebRTC's audio/video component has been disclosed, with affected version ranges specified.

CERT-PY@CERTpyDisclosure

Three new CVEs (CVE-2026-2759, CVE-2026-2758, CVE-2026-2757) affecting Mozilla products are announced, with links provided for more information.

CRAC Learning - Tech@cracbotDisclosure

The post announces CVE-2026-2757, a critical WebRTC boundary condition flaw affecting Firefox versions below 148, with CVSS 9.8, but provides no PoC, exploit, or patch details.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑2757, a boundary‑condition flaw in Firefox’s WebRTC audio/video component, affecting versions below 148 and certain ESR releases.

CRAC Learning - Tech@cracbotDisclosure

The post shares basic information about CVE‑2026‑2757, its severity rating, affected Firefox versions, and a link to the NVD entry, but does not include PoC, exploit details, or patch information.