CVE-2026-2773

Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=2014832 Issue Tracking Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-13/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-14/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-15/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-16/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-17/ Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:3338
https://access.redhat.com/errata/RHSA-2026:3339
https://access.redhat.com/errata/RHSA-2026:3361
https://access.redhat.com/errata/RHSA-2026:3491
https://access.redhat.com/errata/RHSA-2026:3492
https://access.redhat.com/errata/RHSA-2026:3493
https://access.redhat.com/errata/RHSA-2026:3494
https://access.redhat.com/errata/RHSA-2026:3495
https://access.redhat.com/errata/RHSA-2026:3496
https://access.redhat.com/errata/RHSA-2026:3497
https://access.redhat.com/errata/RHSA-2026:3515
https://access.redhat.com/errata/RHSA-2026:3516
https://access.redhat.com/errata/RHSA-2026:3517
https://access.redhat.com/errata/RHSA-2026:3976
https://access.redhat.com/errata/RHSA-2026:3978
https://access.redhat.com/errata/RHSA-2026:3979
https://access.redhat.com/errata/RHSA-2026:3980
https://access.redhat.com/errata/RHSA-2026:3981
https://access.redhat.com/errata/RHSA-2026:3982
https://access.redhat.com/errata/RHSA-2026:3983
https://access.redhat.com/errata/RHSA-2026:3984
https://access.redhat.com/errata/RHSA-2026:4022
https://access.redhat.com/errata/RHSA-2026:4152
https://access.redhat.com/errata/RHSA-2026:4260
https://access.redhat.com/errata/RHSA-2026:4432
https://access.redhat.com/security/cve/CVE-2026-2773
https://bugzilla.redhat.com/show_bug.cgi?id=2442319
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2773.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*

History

30 Jun 2026, 03:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:3338 -
  • () https://access.redhat.com/errata/RHSA-2026:3339 -
  • () https://access.redhat.com/errata/RHSA-2026:3361 -
  • () https://access.redhat.com/errata/RHSA-2026:3491 -
  • () https://access.redhat.com/errata/RHSA-2026:3492 -
  • () https://access.redhat.com/errata/RHSA-2026:3493 -
  • () https://access.redhat.com/errata/RHSA-2026:3494 -
  • () https://access.redhat.com/errata/RHSA-2026:3495 -
  • () https://access.redhat.com/errata/RHSA-2026:3496 -
  • () https://access.redhat.com/errata/RHSA-2026:3497 -
  • () https://access.redhat.com/errata/RHSA-2026:3515 -
  • () https://access.redhat.com/errata/RHSA-2026:3516 -
  • () https://access.redhat.com/errata/RHSA-2026:3517 -
  • () https://access.redhat.com/errata/RHSA-2026:3976 -
  • () https://access.redhat.com/errata/RHSA-2026:3978 -
  • () https://access.redhat.com/errata/RHSA-2026:3979 -
  • () https://access.redhat.com/errata/RHSA-2026:3980 -
  • () https://access.redhat.com/errata/RHSA-2026:3981 -
  • () https://access.redhat.com/errata/RHSA-2026:3982 -
  • () https://access.redhat.com/errata/RHSA-2026:3983 -
  • () https://access.redhat.com/errata/RHSA-2026:3984 -
  • () https://access.redhat.com/errata/RHSA-2026:4022 -
  • () https://access.redhat.com/errata/RHSA-2026:4152 -
  • () https://access.redhat.com/errata/RHSA-2026:4260 -
  • () https://access.redhat.com/errata/RHSA-2026:4432 -
  • () https://access.redhat.com/security/cve/CVE-2026-2773 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2442319 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2773.json -

13 Apr 2026, 15:17

Type Values Removed Values Added
Summary
  • (es) Condiciones de contorno incorrectas en el componente Web Audio. Esta vulnerabilidad afecta a Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, y Thunderbird < 140.8.
Summary (en) Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8. (en) Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

28 Feb 2026, 03:16

Type Values Removed Values Added
CWE CWE-119

25 Feb 2026, 16:37

Type Values Removed Values Added
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
CWE NVD-CWE-noinfo
First Time Mozilla
Mozilla firefox
Mozilla thunderbird
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 9.8
References () https://bugzilla.mozilla.org/show_bug.cgi?id=2014832 - () https://bugzilla.mozilla.org/show_bug.cgi?id=2014832 - Issue Tracking, Permissions Required
References () https://www.mozilla.org/security/advisories/mfsa2026-13/ - () https://www.mozilla.org/security/advisories/mfsa2026-13/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2026-14/ - () https://www.mozilla.org/security/advisories/mfsa2026-14/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2026-15/ - () https://www.mozilla.org/security/advisories/mfsa2026-15/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2026-16/ - () https://www.mozilla.org/security/advisories/mfsa2026-16/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2026-17/ - () https://www.mozilla.org/security/advisories/mfsa2026-17/ - Vendor Advisory

24 Feb 2026, 18:29

Type Values Removed Values Added
References
  • () https://www.mozilla.org/security/advisories/mfsa2026-16/ -
  • () https://www.mozilla.org/security/advisories/mfsa2026-17/ -
Summary (en) Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8. (en) Incorrect boundary conditions in the Web Audio component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.

24 Feb 2026, 14:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-02-24 14:16

Updated : 2026-07-15 02:19


NVD link : CVE-2026-2773

Mitre link : CVE-2026-2773

CVE.ORG link : CVE-2026-2773


JSON object : View

Products Affected

mozilla

  • firefox
  • thunderbird
CWE
NVD-CWE-noinfo CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer