VDB

CVE-2026-2767

CVE-2026-2767 PUBLISHED CVSS 8.8 HIGH

Use-after-free in the JavaScript: WebAssembly component

Reported by mozilla · Published February 24, 2026

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
firefoxWolfi140.8.0-r0
thunderbird-debugsourceerrata.rockylinux.org0:140.8.0-2.el10_1.x86_64, 0:140.8.0-2.el10_1.s390x, 0:140.8.0-2.el10_1.ppc64le, 0:140.8.0-2.el10_1.aarch64, 0:140.8.0-1.el9_7.x86_64, 0:140.8.0-1.el9_7.s390x, 0:140.8.0-1.el9_7.ppc64le, 0:140.8.0-1.el9_7.aarch64, 0:140.8.0-1.el8_10.x86_64, 0:140.8.0-1.el8_10.aarch64
firefox-debugsourceerrata.rockylinux.org0:140.8.0-2.el9_7.x86_64, 0:140.8.0-2.el9_7.s390x, 0:140.8.0-2.el9_7.ppc64le, 0:140.8.0-2.el10_1.x86_64, 0:140.8.0-2.el10_1.s390x, 0:140.8.0-2.el10_1.ppc64le, 0:140.8.0-2.el10_1.aarch64
thunderbird-debuginfoerrata.rockylinux.org0:140.8.0-2.el10_1.x86_64, 0:140.8.0-2.el10_1.s390x, 0:140.8.0-2.el10_1.ppc64le, 0:140.8.0-1.el9_7.x86_64, 0:140.8.0-1.el9_7.s390x, 0:140.8.0-1.el9_7.ppc64le, 0:140.8.0-1.el9_7.aarch64, 0:140.8.0-1.el8_10.x86_64, 0:140.8.0-1.el8_10.aarch64
thunderbirderrata.rockylinux.org0:140.8.0-2.el10_1.x86_64, 0:140.8.0-2.el10_1.src, 0:140.8.0-2.el10_1.s390x, 0:140.8.0-2.el10_1.ppc64le, 0:140.8.0-2.el10_1.aarch64, 0:140.8.0-1.el9_7.x86_64, 0:140.8.0-1.el9_7.src, 0:140.8.0-1.el9_7.s390x, 0:140.8.0-1.el9_7.ppc64le, 0:140.8.0-1.el9_7.aarch64, 0:140.8.0-1.el8_10.x86_64, 0:140.8.0-1.el8_10.src, 0:140.8.0-1.el8_10.aarch64
firefoxerrata.rockylinux.org0:140.8.0-2.el9_7.x86_64, 0:140.8.0-2.el9_7.src, 0:140.8.0-2.el9_7.s390x, 0:140.8.0-2.el9_7.ppc64le, 0:140.8.0-2.el9_7.aarch64, 0:140.8.0-2.el10_1.x86_64, 0:140.8.0-2.el10_1.src, 0:140.8.0-2.el10_1.s390x, 0:140.8.0-2.el10_1.ppc64le, 0:140.8.0-2.el10_1.aarch64
firefox-esrChainguard140.8.0-r0
firefoxAmazon Linux140.8.0-1.amzn2023.0.1
firefox-debuginfoerrata.rockylinux.org0:140.8.0-2.el9_7.x86_64, 0:140.8.0-2.el9_7.s390x, 0:140.8.0-2.el9_7.ppc64le, 0:140.8.0-2.el9_7.aarch64, 0:140.8.0-2.el10_1.x86_64, 0:140.8.0-2.el10_1.s390x, 0:140.8.0-2.el10_1.ppc64le, 0:140.8.0-2.el10_1.aarch64
firefox-x11errata.rockylinux.org0:140.8.0-2.el9_7.x86_64, 0:140.8.0-2.el9_7.s390x, 0:140.8.0-2.el9_7.ppc64le, 0:140.8.0-2.el9_7.aarch64
firefoxChainguard140.8.0-r0
thunderbirdAmazon Linux140.8.0-1.amzn2.0.1

3 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

VendorProductVersions
MozillaFirefox140.8, 148
MozillaThunderbird140.8, 148
wolfifirefox0
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:140.8.0-2.el8_8
Red HatRed Hat Enterprise Linux 6
Red HatRed Hat Enterprise Linux AppStream AUS (v. 8.2)
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support0:140.8.0-2.el8_2
Red HatRed Hat Enterprise Linux 90:140.8.0-1.el9_7
Red HatRed Hat Enterprise Linux AppStream AUS (v.8.6)
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:140.8.0-2.el8_4
MozillaFirefox ESRunspecified
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions0:140.8.0-2.el8_6
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:140.8.0-2.el9_6
Red HatRed Hat Enterprise Linux 10
chainguardfirefox-esr0
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:140.8.0-2.el9_2
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions0:140.8.0-1.el8_6
amazon:2023firefox0
Red HatRed Hat Enterprise Linux AppStream (v. 9)
Red HatRed Hat Enterprise Linux 100:140.8.0-2.el10_1

…and 48 more

Timeline

  • Feb 24, 2026 CVE Published
  • Feb 25, 2026 EPSS Score (30 in total, the first dated here)
  • Mar 17, 2026 Coalition ESS Score (2 in total, the first dated here)
  • Mar 29, 2026 Security Advisory (30 in total, the first dated here)
  • Apr 1, 2026 Distribution Patch (32 in total, the first dated here)
  • Jul 15, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-2767
vulnetix vdb fixes CVE-2026-2767

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-2767/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 13 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›