CVE-2026-2447

HighCVSS 8.8/10Last modified Jul 15, 2026

Description

Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Feb 16, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-244708.1Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.24.0, when running Skipper as an Ingress controller,CVE-2026-244719.3continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local CVE-2026-244725.3Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Cache Middleware contains an CVE-2026-244735.3Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, Serve static Middleware for t CVE-2026-244745.3Dioxus Components is a shadcn-style component library for the Dioxus app framework. Prior to commit 41e4242ecb1062d04ae42a5215363c1d9fd4e23a CVE-2026-244765.4Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with `"` prematurely ends the `<CVE-2026-244777.5AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM p CVE-2026-244787.2AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version CVE-2026-244799.8HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_im CVE-2026-24488.8The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via t CVE-2026-244808.7QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "CVE-2026-244817.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a h