CVE-2026-5734
Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.
| Vendor | mozilla |
| Product | firefox |
| Ecosystems | |
| Industries | Technology |
| Published | Apr 7, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for mozilla firefox
Be the first to know when new high vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Mozilla / Firefox
All versions affected Mozilla / Thunderbird
All versions affected References
bugzilla.mozilla.org: https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022369%2C2023026%2C2023545%2C2023555%2C2023958%2C2025422%2C2025468%2C2025492%2C2025505 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-25/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-27/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-28/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-29/ access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-5734 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2455897 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5734.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13977 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13665 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11813 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7672 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9638 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8052 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9345 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11805 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13600 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14303 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13683 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:15889 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13682 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14223 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13596 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:12264 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13922 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13412 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13582 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13533 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13583 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13342 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7671 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8459
Credits
Brian Grinstead, Christian Holler, Tom Schuster and the Mozilla Fuzzing Team