CVE-2026-0880

—

CVSS 3.1

8.8 high

EPSS

<1%p47

Published

Jan 13, 2026 (Jan 13, 2026)

Modified

Jul 15, 2026

Description

Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Vendors: mozilla
Products: firefox, thunderbird
Weakness: CWE-190
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.