CVE-2026-2785

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-824

Affected software

No affected versions have been published.

Timeline

Published: Feb 24, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-278507.5Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all CVE-2026-278519.1When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabli CVE-2026-278527.5An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters CVE-2026-278537.5An attacker might be able to trigger an out-of-bounds write by sending crafted DNS responses to a DNSdist using the DNSQuestion:changeName o CVE-2026-278547.5An attacker might be able to trigger a use-after-free by sending crafted DNS queries to a DNSdist using the DNSQuestion:getEDNSOptions metho CVE-2026-278555.9Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in pa CVE-2026-278565.9Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine CVE-2026-278577.5Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client CVE-2026-278587.5Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacke CVE-2026-278595.3A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message ca CVE-2026-27869.8Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thun CVE-2026-278605.3If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially