A critical heap buffer overflow in the libvpx library affects Mozilla Firefox and Thunderbird, posing a significant risk of remote code execution.

This is a heap buffer overflow vulnerability within the libvpx video codec library. The vulnerability is triggered by an unauthenticated remote attacker through the processing of malformed media data, which could lead to memory corruption and potential code execution.

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise if exploited. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the browser or mail client, leading to potential data theft, malware installation, or unauthorized access to sensitive user information.

Immediate Action: Update all instances of Mozilla Firefox and Mozilla Thunderbird to the versions specified in the Mozilla security advisories (MFSA2026-10 and MFSA2026-11).

Proactive Monitoring: Review enterprise endpoint logs for unusual process crashes related to media processing or unexpected outbound network connections initiated by browser or mail processes.

Compensating Controls: While no direct virtual patch exists for this library-level flaw, enforcing strict endpoint security policies and using browser-based sandboxing can help mitigate the impact of code execution attempts.

Public Exploit Available: No

Given the potential for remote code execution and the ubiquity of these applications in enterprise environments, immediate patching is required. Administrators should prioritize the deployment of the identified updates across all workstations to neutralize this critical risk.