CVE-2026-2757

CriticalCVSS 9.8/10Last modified Jul 15, 2026

Description

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1384

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 7—

References

Timeline

Published
Feb 24, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-275706.1Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the onebox method in the ShareCVE-2026-275717.5NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling of NATS messages hanCVE-2026-275727.5Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of the `wasi:CVE-2026-275749.9OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses NoCVE-2026-275759.1Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (CVE-2026-275764.0OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the ACP bridge accepts very large prompt text blocks and can assemble CVE-2026-275779.9n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaCVE-2026-275785.4n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to CVE-2026-275797.4CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the apCVE-2026-27589.8Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, ThunderbCVE-2026-275847.5Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server componeCVE-2026-275856.5Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine in file matcher does
CVE-2026-2757: Critical severity, CVSS 9.8 | Vulnix