Skip to main content

Firefox Esr CVE-2026-5731

| EUVDEUVD-2026-19610 CRITICAL
Buffer Overflow (CWE-119)
2026-04-07 mozilla GHSA-fwrw-mfrr-q8px
RCE Buffer Overflow Mozilla Firefox Esr
9.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send malicious web content to victim
  2. Exploit
    Trigger memory safety bug in Firefox parser
  3. Execution
    Corrupt heap memory structure
  4. Impact
    Execute arbitrary code with browser privileges

Vulnerability Assessment

Weakness
CWE
CWE-119
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, buffer size validation
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Remote unauthenticated attacker can exploit memory safety bugs by sending specially crafted network content to vulnerable Firefox versions (< 149.0.2), Firefox ESR (< 115.34.1 or < 140.9.1), or Thunderbird (< 149.0.1). Victim must visit a malicious website or open a crafted file in the affected browser/email client. Default configurations are vulnerable.
Impact

CVSS 9.8 correctly reflects critical real-world risk: network attack vector (AV:N) enables remote exploitation via malicious websites, low attack complexity (AC:L) means reliable exploitation without race conditions, no privileges required (PR:N) and no user interaction (UI:N) enable drive-by attacks, and full confidentiality/integrity/availability impact (C:H/I:H/A:H) confirms arbitrary code execution potential. Mozilla's explicit statement that memory corruption bugs 'could have been exploited to run arbitrary code' indicates vendor assessment of exploitability beyond theoretical concerns. The absence of KEV listing and public POC at time of analysis moderates immediate threat, but browser memory corruption vulnerabilities historically transition rapidly from disclosure to exploitation due to attacker interest in browser attack surface. The 28 referenced bug IDs suggest systematic vulnerability discovery through fuzzing, which typically identifies exploitable conditions. Enterprise environments running Firefox ESR face extended exposure windows if update cycles lag, though no confirmed exploitation exists. SSVC framework assessment: exploitation status is none (no POC/KEV), automatable is yes (browser vulnerabilities enable automated exploitation via malicious content delivery), technical impact is total (arbitrary code execution). Priority: immediate patching for internet-facing browser deployments.
Exploit ScenarioDerived

An attacker hosts malicious web content designed to trigger memory corruption during HTML parsing or JavaScript execution in vulnerable Firefox versions. When a user visits the compromised website or clicks a malicious link, the attacker's crafted input exploits buffer overflow conditions (CWE-119) to overwrite adjacent memory structures, hijacking program control flow. With no authentication required and no user interaction beyond navigation (CVSS PR:N/UI:N), the exploit executes arbitrary code within the browser process context, enabling installation of malware, credential theft from browser password stores, or pivot attacks against internal networks in enterprise environments. The low attack complexity (AC:L) suggests reliable exploitation once vulnerability primitives are identified from the 28 disclosed bug reports.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 07, 2026

Remote code execution in Mozilla Firefox and Thunderbird via memory corruption vulnerabilities allows unauthenticated remote attackers to execute arbitrary code without user interaction. Affects Firefox <149.0.2, Firefox ESR <115.34.1, and Firefox ESR <140.9.1 across desktop platforms. With CVSS 9.8 (critical severity, network-accessible, no privileges required) and CWE-119 buffer overflow classification, this represents multiple memory safety bugs that Mozilla assessed could be exploited for arbitrary code execution. No public exploit identified at time of analysis; EPSS data not provided but critical browser vulnerabilities historically attract rapid exploitation interest.

RemediationAI

Upgrade immediately to patched versions: Firefox 149.0.2 or later for mainline users, Firefox ESR 115.34.1 or later for organizations on the ESR 115 branch, and Firefox ESR 140.9.1 or later for ESR 140 branch deployments. Mozilla released these fixes simultaneously across all affected branches per security advisories MFSA2026-25 (https://www.mozilla.org/security/advisories/mfsa2026-25/), MFSA2026-26 (https://www.mozilla.org/security/advisories/mfsa2026-26/), and MFSA2026-27 (https://www.mozilla.org/security/advisories/mfsa2026-27/). Enterprise environments using centralized deployment tools should prioritize Firefox ESR updates through existing patch management workflows. No effective workarounds exist for memory corruption vulnerabilities in browser engines; version upgrade is the only remediation. Firefox's automatic update mechanism will deliver patches to consumer installations, but administrators should verify update completion across managed endpoints. Review the 28 referenced Bugzilla tickets for technical details if conducting impact assessment for custom Firefox builds or embedded Gecko applications.

Affected VersionsENISA

Firefox ESR unspecified <115.34.1
Firefox ESR unspecified <140.9.1
Firefox unspecified <149.0.2

Affected Packages

euvd firefox_esr_unspecified fix: 115.34.1, 140.9.1
euvd firefox_unspecified fix: 149.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

CWE-119 buffer overflow vulnerabilities represent memory boundary violations enabling arbitrary memory reads/writes in Firefox's rendering engine and core components. The Mozilla advisory references 28 distinct Bugzilla tickets spanning multiple subsystems, indicating a coordinated fix release addressing widespread memory safety issues discovered through Mozilla's internal security audits and fuzzing operations. CPE identifiers confirm impact across both Firefox mainline (consumer release channel) and Firefox ESR (Extended Support Release for enterprise deployments). Buffer overflow vulnerabilities in browser engines are particularly severe because they occur in the attack surface exposed to untrusted web content, allowing malicious websites or content to trigger memory corruption during HTML/CSS/JavaScript processing, media decoding, or network protocol handling. The multiple affected ESR branches (115.x and 140.x) indicate long-standing code patterns requiring remediation across major version lineages.

Know when Firefox Esr gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE CRITICAL
Red Hat 8.8 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Updated
Apr 16, 2026 - 05:45 EUVD-patch-fix
executive summary
Patch available
Apr 16, 2026 - 05:29 EUVD
115.34.1,140.9.1,149.0.2
CVE Published
Apr 07, 2026 - 12:43 nvd
CRITICAL 9.8

DescriptionCVE.org

Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149.0.2, Firefox ESR < 115.34.1, and Firefox ESR < 140.9.1.

Executive ViewAI

Why It Matters

Mozilla Firefox and Thunderbird contain critical memory corruption vulnerabilities allowing unauthenticated remote code execution with no user interaction required, affecting all desktop users running unpatched versions. Organizations must immediately patch affected browsers to prevent potential compromise of employee systems, credential theft, and lateral network movement, as critical browser vulnerabilities typically face rapid exploitation development.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is infeasible, implement network-level controls: restrict Firefox/Thunderbird outbound access to whitelisted domains only, disable JavaScript execution in browser security policies where operationally viable, and increase endpoint monitoring for suspicious process creation or memory injection attempts. These mitigations do not substitute for patching and are temporary measures only.

Threat Intelligence Overview

EPSS Score
0.1%
Top 83% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in Firefox Memory Safety Issues

View all 3
CVE-2026-5735 CRITICAL
9.8
CVE-2026-5734 CRITICAL
9.8

More in Firefox Esr

View all
CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2020-26950 HIGH POC
8.8 Dec 09

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable

CVE-2026-4689 CRITICAL POC
10.0 Mar 24

A sandbox escape vulnerability exists in Firefox's XPCOM component due to incorrect boundary conditions and integer over
CVE-2022-29917 CRITICAL POC
9.8 Dec 22

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bug
CVE-2014-1568 HIGH
7.5 Sep 25

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozi
CVE-2022-26384 CRITICAL POC
9.6 Dec 22

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scri
CVE-2022-34484 HIGH POC
8.8 Dec 22

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Rated high severity (CVSS 8.8)
CVE-2022-28281 HIGH POC
8.8 Dec 22

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent pr
CVE-2022-26381 HIGH POC
8.8 Dec 22

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploi
CVE-2022-22756 HIGH POC
8.8 Dec 22

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been
CVE-2022-22740 HIGH POC
8.8 Dec 22

Certain network request objects were freed too early when releasing a network request handle. Rated high severity (CVSS

CVE-2022-22738 HIGH POC
8.8 Dec 22

Applying a CSS filter effect could have accessed out of bounds memory. Rated high severity (CVSS 8.8), this vulnerabilit

Same weakness CWE-119 – Buffer Overflow

View all
CVE-2020-0796 CRITICAL POC
10.0
CVE-2017-11882 HIGH POC
7.8
CVE-2014-6332 HIGH POC
8.8
CVE-2015-2426 HIGH POC
8.8
CVE-2013-3918 HIGH POC
8.8
CVE-2023-4966 HIGH POC
7.5
CVE-2017-11774 HIGH POC
7.8
CVE-2013-3660 HIGH POC
7.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:7671 ADVISORY https://access.redhat.com/errata/RHSA-2026:7672 ADVISORY https://access.redhat.com/errata/RHSA-2026:8052 ADVISORY https://access.redhat.com/errata/RHSA-2026:8459 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5731 ADVISORY https://vuldb.com/vuln/355739 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1273/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1322/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1379/ REF https://access.redhat.com/errata/RHSA-2026:11805 REF https://access.redhat.com/errata/RHSA-2026:11813 REF https://access.redhat.com/errata/RHSA-2026:12264 REF https://access.redhat.com/errata/RHSA-2026:13342 REF https://access.redhat.com/errata/RHSA-2026:13412 REF https://access.redhat.com/errata/RHSA-2026:13533 REF https://access.redhat.com/errata/RHSA-2026:13582 REF https://access.redhat.com/errata/RHSA-2026:13583 REF https://access.redhat.com/errata/RHSA-2026:13596 REF https://access.redhat.com/errata/RHSA-2026:13600 REF https://access.redhat.com/errata/RHSA-2026:13665 REF https://access.redhat.com/errata/RHSA-2026:13682 REF https://access.redhat.com/errata/RHSA-2026:13683 REF https://access.redhat.com/errata/RHSA-2026:13922 REF https://access.redhat.com/errata/RHSA-2026:13977 REF https://access.redhat.com/errata/RHSA-2026:14223 REF https://access.redhat.com/errata/RHSA-2026:14303 REF https://access.redhat.com/errata/RHSA-2026:15889 REF https://access.redhat.com/errata/RHSA-2026:9345 REF https://access.redhat.com/errata/RHSA-2026:9638 REF https://access.redhat.com/security/cve/CVE-2026-5731 REF https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021894%2C2022225%2C2022252%2C2022294%2C2023007%2C2023130%2C2023191%2C2023364%2C2023829%2C2024074%2C2024417%2C2024433%2C2024436%2C2024437%2C2024453%2C2024461%2C2024462%2C2024472%2C2024474%2C2024477%2C2025364%2C2025401%2C2025402%2C2025472%2C2026287%2C2026299%2C2026305%2C2026426 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455901 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5731.json REF https://www.mozilla.org/security/advisories/mfsa2026-25/ REF https://www.mozilla.org/security/advisories/mfsa2026-26/ REF https://www.mozilla.org/security/advisories/mfsa2026-27/ REF https://www.mozilla.org/security/advisories/mfsa2026-28/ REF https://www.mozilla.org/security/advisories/mfsa2026-29/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy