CVE-2026-84141 is an integer overflow in the Graphics ImageLib component of Firefox and Thunderbird. NVD scores it 9.8, while Mozilla rates its impact as low. It is fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155 and Thunderbird 153.2, so update to one of those.
What's affected
The record lists the fix as Firefox 155, Firefox ESR 153.2, Thunderbird 155 and Thunderbird 153.2. Mozilla's advisories MFSA 2026-82 and MFSA 2026-85, announced on 1 September 2026, list it as CVE-2026-84141 with an impact of low and a link to Bug 2063994.
Earlier versions of these products are affected. Mozilla's entry names the component and the class of bug and gives no more detail.
How to check if you're exposed
Check the installed version in the application's About window, or from a terminal.
firefox --version
thunderbird --version
Compare to Firefox 155, Firefox ESR 153.2, Thunderbird 155 or Thunderbird 153.2. If you manage many devices, read versions from your software inventory and list those below the fixed releases. A dependency scan like the free one at https://gold.safeguard.sh/scan helps when Firefox code is embedded in other software.
What to do now
- Update Firefox to 155 or later, or ESR to 153.2 or later.
- Update Thunderbird to 155 or 153.2 or later.
- Check that automatic updates are enabled and not blocked by policy.
- Include the browser in your patch reporting, with Mozilla's severity next to the CVSS score.
- Review the remaining entries in Mozilla's advisories for anything that matches your use.
Why it matters
The weakness is CWE-190, integer overflow or wraparound. A size calculation wraps to a small number, a buffer gets sized from that small number, and later code treats the buffer as larger than it is. Image decoding is a classic place for this because sizes come from untrusted files.
Mozilla rates this issue low, which suggests the real effect is limited, for example by existing protections. NVD's 9.8 uses a worst case vector. Both can be true. The practical answer is the same, which is to update. The record is not listed in CISA's KEV catalog.
Image decoding is among the most heavily fuzzed parts of any browser, which is why bugs like this are found and fixed quickly. A decoder takes sizes from a file that an attacker can craft, and arithmetic on those sizes can wrap around. Mozilla's low rating suggests the wrapped value does not lead to an easy way to control memory. That is a reasonable engineering view, and it is not a promise that nothing can be built on it.
For teams that track patching against CVSS thresholds, this record is a good test case. A threshold on score alone would call this an emergency. A policy that also reads the vendor's rating would call it routine. Pick the policy on purpose, write it down, and apply it the same way to every record.
Whichever way you rank it, the action is the same: get Firefox, ESR and Thunderbird to the fixed releases. Updates for these products are free, and the work is mostly making sure they actually reach each device.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why would a 9.8 be rated low by the vendor?
NVD often scores the worst case for a bug class. The vendor knows the code and its protections, so it may rate the practical impact lower.
Sources
- Mozilla Foundation Security Advisory 2026-82 (Firefox 155)
- Mozilla Foundation Security Advisory 2026-85 (Firefox ESR 153.2)
Last reviewed: 19 October 2026.
