CVE-2026-2806 is an uninitialized memory bug in the Graphics: Text component of Firefox and Thunderbird. NVD scores it 9.1 (Critical), while Mozilla rates its impact low. Mozilla fixed it in Firefox 148 and Thunderbird 148 on 24 February 2026, so update to 148 or later.
What's affected
The record covers Firefox and Thunderbird, fixed in Firefox 148 and Thunderbird 148. Mozilla's advisories are MFSA 2026-13 and MFSA 2026-16.
This is the clearest example in the release of a gap between scores. NVD gives it 9.1 with high confidentiality and availability impact. Mozilla labels it low. Without more detail from the vendor, the sensible reading is that the practical risk is lower than the number suggests, and that the update is still worth applying at normal speed.
Mozilla's Thunderbird advisory adds a useful note: in general these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but they are potential risks in browser or browser-like contexts. Update anyway, since the fix ships in the same release.
How to check if you're exposed
Check the version number first.
- Firefox: open the menu, choose Help, then About Firefox. On Linux you can also run the command below.
- Thunderbird: open the menu, choose Help, then About Thunderbird.
firefox --version
Anything below 148 is in scope. If a package manager or an enterprise policy controls updates on your machines, check the installed package version there as well, because a browser that has not restarted since an update can still be running old code.
What to do now
- Update Firefox to 148 or later.
- Update Thunderbird to 148 or later.
- Restart both applications.
- Confirm versions on managed machines at your next normal patch check.
- Do not escalate to an emergency change unless your own risk model says otherwise.
Why it matters
Two weakness classes are attached to this record: CWE-457 (Use of Uninitialized Variable) and CWE-908 (Use of Uninitialized Resource). Both describe code that reads memory before anything has written a meaningful value to it. The usual consequence is that stale data from earlier use of that memory shows up where the program expects fresh data, which can leak information or cause unstable behaviour.
The scoring vector in NVD lists high confidentiality and high availability impact and no integrity impact, which is consistent with a memory disclosure or crash profile. Mozilla's low rating suggests the exposed data is limited in practice. The advisory gives no more detail than the component name, so this post does not speculate.
Nothing in the record says this is exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Should I treat a 9.1 as an emergency?
Not on its own. Mozilla rates the impact low. Apply the update on your normal browser patch schedule, which for most teams is quick anyway.
Which components does this affect?
Graphics: Text, in Firefox and Thunderbird before version 148.
Sources
- Mozilla Foundation Security Advisory 2026-13 (Firefox 148)
- Mozilla Foundation Security Advisory 2026-16 (Thunderbird 148)
Last reviewed: 19 October 2026.
