# ALSA-2026:3339: Security update for 2 packages ALSA-2026:3339, released February 25, 2026, fixes 38 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/alsa-2026-3339 - Platform: Linux - Released: Feb 25, 2026 - Priority: High (Closes CVE-2026-2773, high severity) - CVEs: 38, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/ALSA-2026:3339 ## Applies to | Product | Release | Fixed in | |---|---|---| | [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | almalinux 9 | 140.8.0-2.el9_7.alma.1 | | [firefox-x11](https://patchblox.com/security/data/product/linux/firefox-x11.md) | almalinux 9 | 140.8.0-2.el9_7.alma.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-2773](https://patchblox.com/security/data/cve/CVE-2026-2773.md) | High | Incorrect boundary conditions in the Web Audio component | 9.8 | 0.0092 | | | [CVE-2026-2774](https://patchblox.com/security/data/cve/CVE-2026-2774.md) | High | Integer overflow in the Audio/Video component | 9.8 | 0.0085 | | | [CVE-2026-2775](https://patchblox.com/security/data/cve/CVE-2026-2775.md) | High | Mitigation bypass in the DOM: HTML Parser component | 9.8 | 0.0084 | | | [CVE-2026-2771](https://patchblox.com/security/data/cve/CVE-2026-2771.md) | High | Undefined behavior in the DOM: Core & HTML component | 9.8 | 0.0076 | | | [CVE-2026-2763](https://patchblox.com/security/data/cve/CVE-2026-2763.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0074 | | | [CVE-2026-2764](https://patchblox.com/security/data/cve/CVE-2026-2764.md) | High | JIT miscompilation, use-after-free in the JavaScript Engine: JIT component | 9.8 | 0.0074 | | | [CVE-2026-2765](https://patchblox.com/security/data/cve/CVE-2026-2765.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0074 | | | [CVE-2026-2766](https://patchblox.com/security/data/cve/CVE-2026-2766.md) | High | Use-after-free in the JavaScript Engine: JIT component | 9.8 | 0.0074 | | | [CVE-2026-2770](https://patchblox.com/security/data/cve/CVE-2026-2770.md) | High | Use-after-free in the DOM: Bindings (WebIDL) component | 9.8 | 0.0074 | | | [CVE-2026-2772](https://patchblox.com/security/data/cve/CVE-2026-2772.md) | High | Use-after-free in the Audio/Video: Playback component | 9.8 | 0.0074 | | | [CVE-2026-2447](https://patchblox.com/security/data/cve/CVE-2026-2447.md) | High | Heap buffer overflow in libvpx | 8.8 | 0.0070 | | | [CVE-2026-2779](https://patchblox.com/security/data/cve/CVE-2026-2779.md) | High | Incorrect boundary conditions in the Networking: JAR component | 9.8 | 0.0069 | | | [CVE-2026-2769](https://patchblox.com/security/data/cve/CVE-2026-2769.md) | High | Use-after-free in the Storage: IndexedDB component | 8.8 | 0.0069 | | | [CVE-2026-2788](https://patchblox.com/security/data/cve/CVE-2026-2788.md) | High | Incorrect boundary conditions in the Audio/Video: GMP component | 9.8 | 0.0068 | | | [CVE-2026-2787](https://patchblox.com/security/data/cve/CVE-2026-2787.md) | High | Use-after-free in the DOM: Window and Location component | 9.8 | 0.0064 | | | [CVE-2026-2762](https://patchblox.com/security/data/cve/CVE-2026-2762.md) | High | Integer overflow in the JavaScript: Standard Library component | 9.8 | 0.0063 | | | [CVE-2026-2791](https://patchblox.com/security/data/cve/CVE-2026-2791.md) | High | Mitigation bypass in the Networking: Cache component | 9.8 | 0.0060 | | | [CVE-2026-2757](https://patchblox.com/security/data/cve/CVE-2026-2757.md) | High | Incorrect boundary conditions in the WebRTC: Audio/Video component | 9.8 | 0.0059 | | | [CVE-2026-2785](https://patchblox.com/security/data/cve/CVE-2026-2785.md) | High | Invalid pointer in the JavaScript Engine component | 9.8 | 0.0058 | | | [CVE-2026-2758](https://patchblox.com/security/data/cve/CVE-2026-2758.md) | High | Use-after-free in the JavaScript: GC component | 9.8 | 0.0057 | | | [CVE-2026-2776](https://patchblox.com/security/data/cve/CVE-2026-2776.md) | High | Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software | 10.0 | 0.0056 | | | [CVE-2026-2778](https://patchblox.com/security/data/cve/CVE-2026-2778.md) | High | Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component | 10.0 | 0.0056 | | | [CVE-2026-2789](https://patchblox.com/security/data/cve/CVE-2026-2789.md) | High | Use-after-free in the Graphics: ImageLib component | 9.8 | 0.0053 | | | [CVE-2026-2786](https://patchblox.com/security/data/cve/CVE-2026-2786.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0051 | | | [CVE-2026-2784](https://patchblox.com/security/data/cve/CVE-2026-2784.md) | High | Mitigation bypass in the DOM: Security component | 9.8 | 0.0049 | | | [CVE-2026-2760](https://patchblox.com/security/data/cve/CVE-2026-2760.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | 10.0 | 0.0048 | | | [CVE-2026-2761](https://patchblox.com/security/data/cve/CVE-2026-2761.md) | High | Sandbox escape in the Graphics: WebRender component | 10.0 | 0.0048 | | | [CVE-2026-2759](https://patchblox.com/security/data/cve/CVE-2026-2759.md) | High | Incorrect boundary conditions in the Graphics: ImageLib component | 9.8 | 0.0048 | | | [CVE-2026-2767](https://patchblox.com/security/data/cve/CVE-2026-2767.md) | High | Use-after-free in the JavaScript: WebAssembly component | 9.8 | 0.0046 | | | [CVE-2026-2768](https://patchblox.com/security/data/cve/CVE-2026-2768.md) | High | Sandbox escape in the Storage: IndexedDB component | 10.0 | 0.0044 | | | [CVE-2026-2777](https://patchblox.com/security/data/cve/CVE-2026-2777.md) | High | Privilege escalation in the Messaging System component | 9.8 | 0.0044 | | | [CVE-2026-2781](https://patchblox.com/security/data/cve/CVE-2026-2781.md) | High | Integer overflow in the Libraries component in NSS | 9.8 | 0.0043 | | | [CVE-2026-2780](https://patchblox.com/security/data/cve/CVE-2026-2780.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0040 | | | [CVE-2026-2792](https://patchblox.com/security/data/cve/CVE-2026-2792.md) | High | Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 | 9.8 | 0.0038 | | | [CVE-2026-2793](https://patchblox.com/security/data/cve/CVE-2026-2793.md) | High | Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 | 9.8 | 0.0038 | | | [CVE-2026-2783](https://patchblox.com/security/data/cve/CVE-2026-2783.md) | High | Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0034 | | | [CVE-2026-2782](https://patchblox.com/security/data/cve/CVE-2026-2782.md) | High | Privilege escalation in the Netmonitor component | 9.8 | 0.0034 | | | [CVE-2026-2790](https://patchblox.com/security/data/cve/CVE-2026-2790.md) | High | Same-origin policy bypass in the Networking: JAR component | 9.8 | 0.0025 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo