CVE-2026-2805: Invalid Pointer in Firefox and Thunderbird DOM

CVE-2026-2805 is an invalid pointer bug in the DOM: Core and HTML component of Firefox and Thunderbird. NVD scores it 9.8 (Critical), while Mozilla rates the impact moderate. It was fixed in Firefox 148 and Thunderbird 148 on 24 February 2026. Update and restart both applications.

What's affected

The NVD record names Firefox and Thunderbird and says the issue was fixed in Firefox 148 and Thunderbird 148. The advisories are MFSA 2026-13 for Firefox and MFSA 2026-16 for Thunderbird.

Mozilla's own impact label for this entry is moderate, below the high rating it gave to the use-after-free bugs fixed in the same release. NVD's score is 9.8. Use the gap as a prioritisation hint, not a reason to skip the update.

Mozilla's Thunderbird advisory adds a useful note: in general these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potential risks in browser or browser-like contexts. Update anyway, since the fix ships in the same release.

How to check if you're exposed

Check the version number first.

• Firefox: open the menu, choose Help, then About Firefox. On Linux you can also run the command below.
• Thunderbird: open the menu, choose Help, then About Thunderbird.

firefox --version

Anything below 148 is in scope. If a package manager or an enterprise policy controls updates on your machines, check the installed package version there as well, because a browser that has not restarted since an update can still be running old code.

What to do now

1. Update Firefox to 148 or later.
2. Update Thunderbird to 148 or later.
3. Restart each application after the update.
4. Confirm the version on managed endpoints.
5. Rebuild any image or appliance that bundles Firefox or Thunderbird.

Why it matters

The weakness is CWE-824 (Access of Uninitialized Pointer). A pointer that was never set to a valid value points somewhere arbitrary, and code that follows it can read or write memory it should not touch. In memory unsafe languages this kind of bug is a known source of crashes and, in the worst cases, of code execution.

Mozilla's advisory describes it only as an invalid pointer in the DOM: Core and HTML component, and does not provide a mechanism. This post stays at that level.

Browsers ship fixes for several memory bugs in nearly every release. Staying current is the control that matters most, because it removes the whole batch at once rather than one CVE at a time. The record does not report exploitation and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.

Quick check

Sources

• Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
• Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)

Last reviewed: 19 October 2026.