Search CVEs, research… / diras.sa

CVE-2026-84141: integer overflow in Mozilla Firefox

Remote attackers can trigger an integer overflow in Firefox's Graphics: ImageLib component, potentially leading to crashes or arbitrary code execution — CVE-2026-84141. The vulnerability stems from integer handling in the image library and affects Firefox builds that include that component; specific affected version ranges are not listed in the provided data. Exploitation requires network access to a vulnerable Firefox instance and needs no authentication or user interaction according to the published CVSS vector.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.0063
CWE
CWE-190
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: this is a critical (CVSS 9.8) remote flaw with no vendor patch currently available, so prioritize reducing exposure of Firefox clients and preparing to apply Mozilla updates as soon as they are released.

What is CVE-2026-84141?

Remote attackers can trigger an integer overflow in Firefox's Graphics: ImageLib component, potentially leading to crashes or arbitrary code execution — CVE-2026-84141. The vulnerability stems from integer handling in the image library and affects Firefox builds that include that component; specific affected version ranges are not listed in the provided data. Exploitation requires network access to a vulnerable Firefox instance and needs no authentication or user interaction according to the published CVSS vector.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Mozilla Firefox are affected?

BRANCHAFFECTEDFIXED

Is CVE-2026-84141 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-84141

  1. Restrict network exposure of vulnerable Firefox clients and block untrusted content sources at network edges.
  2. Enable and enforce automatic updates for Firefox and plan to install vendor updates immediately when Mozilla publishes a patch.
  3. Monitor endpoints and network logs for crashes or anomalous image-processing activity related to Firefox's image handling.
  4. Apply vendor guidance and hardening recommendations from Mozilla and increase monitoring of affected systems until a patch is installed.

Frequently asked questions

Is CVE-2026-84141 being actively exploited?

There are no public reports of exploitation as of 2026-09-29.

Which Firefox versions are affected by CVE-2026-84141?

The flaw is in Firefox's Graphics: ImageLib component; the provided data does not list specific affected version ranges.

Is there a patch for CVE-2026-84141?

No—there is no patch available in the provided data as of 2026-09-29; monitor Mozilla advisories for updates.

Does CVE-2026-84141 require authentication?

No—according to the CVSS vector, the vulnerability requires no privileges and no user interaction, so it does not require authentication.

References