High RHSA-2026:5320 1 CVE

Red Hat Security Advisory: libvpx security update

Published Mar 23, 2026 · Updated Oct 2, 2026

Ecosystem: Red Hat

Fixed packages 4

Release	Package	Fixed in
Red Hat · RHEL 7 ELS rhel_els:7	libvpx	0:1.3.0-8.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7	libvpx-debuginfo	0:1.3.0-8.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7	libvpx-devel	0:1.3.0-8.el7_9.3
Red Hat · RHEL 7 ELS rhel_els:7	libvpx-utils	0:1.3.0-8.el7_9.3

Vulnerabilities 1

High 8.8

CVE-2026-2447

Heap buffer overflow in libvpx

Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Feb 16, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2440219
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5320.json
report
https://access.redhat.com/security/cve/CVE-2026-2447
advisory
https://www.cve.org/CVERecord?id=CVE-2026-2447
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2447
article
https://bugzilla.mozilla.org/show_bug.cgi?id=2014390
article
https://www.mozilla.org/security/advisories/mfsa2026-10/