Vulnerability details
CVE-2026-2447
Red Hat Enterprise Linux 10
Heap buffer overflow in libvpx
CVSS 3.1
7.5High
Official description
Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.8High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
References and advisories
49- https://bugzilla.mozilla.org/show_bug.cgi?id=2014390
- https://www.mozilla.org/security/advisories/mfsa2026-10/
- https://www.mozilla.org/security/advisories/mfsa2026-11/
- https://lists.debian.org/debian-lts-announce/2026/02/msg00028.html
- https://access.redhat.com/security/cve/CVE-2026-2447 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2440219 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2447.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:3984 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5320 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3976 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5227 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4260 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3361 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4629 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3517 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3338 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3967 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3515 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3492 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5228 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4432 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3491 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5323 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3980 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3495 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5229 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3979 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3494 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5230 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4022 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3493 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5326 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3983 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4152 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5319 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3978 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3496 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5324 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3981 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3497 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5231 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3982 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3339 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4447 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3516 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8748 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8746 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8747 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:16174 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-16
- Last updated
- 2026-07-15
- State
- Published
- Assigner (CNA)
- mozilla
Exploit prediction (EPSS)
0.69%
Probability of exploitation in 30 days
53.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-122Heap-based Buffer Overflow