CVE-2026-2806 Details
Description
Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
A vulnerability exists in the Graphics: Text component of Mozilla Firefox and Thunderbird, specifically in versions prior to 148. This issue stems from uninitialized memory, which can lead to potential memory safety problems.
Users can upgrade to Firefox or Thunderbird version 148 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=2006199 | [email protected] | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2026-13/ | [email protected] | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2026-16/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
| CWE-457 | Use of Uninitialized Variable | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mozilla firefox | < 148.0 |
CPE
Remediation
| |
| mozilla thunderbird | < 148.0 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 13, 2026 | CVE Modified | [email protected] |
| Feb 25, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 24, 2026 | CVE Modified | [email protected] |
| Feb 24, 2026 | New CVE Received | [email protected] |