Mozilla rolled out an urgent security update for Firefox on February 16, 2026, fixing a high-severity heap buffer overflow in the libvpx video codec library.
This flaw, tracked as CVE-2026-2447, impacts video processing for VP8 and VP9 formats, which Firefox uses widely across desktop and mobile platforms.
Security researcher Jayjayjazz discovered the issue, prompting quick patches in Firefox 147.0.4, Firefox ESR 140.7.1, and Firefox ESR 115.32.1.
A heap buffer overflow happens when software writes data past the end of its allocated memory buffer in the heap—the dynamic memory area programs use at runtime.
Attackers can exploit this by sending oversized or malformed video data, overwriting adjacent memory.
This leads to arbitrary code execution, browser crashes, or full system compromise without user interaction beyond visiting a malicious site or playing rigged video content.
Remote hackers could leverage it via crafted web pages, embedding exploit payloads in seemingly innocent media streams.
Mozilla rates CVE-2026-2447 as high-impact in its MFSA 2026-10 advisory, highlighting risks to millions of users on Windows, macOS, and Linux.
No widespread exploits appear in the wild yet, but the vulnerability’s ease of remote triggering makes it a prime target for drive-by attacks.
| CVE ID | CVSS Score | Severity | Description |
|---|---|---|---|
| CVE-2026-2447 | N/A | High | Heap buffer overflow in libvpx library affecting video processing |
Affected and Patched Versions
| Firefox Edition | Vulnerable Versions | Patched Version |
|---|---|---|
| Firefox | < 147.0.4 | 147.0.4 |
| Firefox ESR | < 140.7.1 | 140.7.1 |
| Firefox ESR | < 115.32.1 | 115.32.1 |
Users should update immediately via Firefox’s Help > About Firefox menu, which checks and applies patches automatically.
Alternatively, download fresh installers from Mozilla’s site. Enterprises managing ESR branches must prioritize deployment to avoid exposure.
This release underscores libvpx’s role in multimedia-heavy browsing and the need for vigilant patching.
Similar overflows have fueled past campaigns, like those targeting media players. Stay ahead by enabling auto-updates and monitoring CISA alerts.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google
%20(1).webp?fit=1600,900&ssl=1&description=This flaw, tracked as CVE-2026-2447, impacts video processing for VP8 and VP9 formats, which Firefox uses widely across desktop and mobile platforms.){kind=link}