Skip to main content

Firefox Esr CVE-2026-5732

| EUVDEUVD-2026-19611 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-04-07 mozilla GHSA-mj57-mxq8-qvw9
Buffer Overflow Integer Overflow Mozilla Firefox Esr
8.8
CVSS 3.1 · Vendor: mozilla
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    User visits malicious webpage
  2. Delivery
    Browser renders crafted text element
  3. Exploit
    Integer overflow in Graphics Text component
  4. Execution
    Memory corruption occurs
  5. Impact
    Arbitrary code execution with user privileges

Vulnerability Assessment

Weakness
CWE
CWE-190
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Attacker sends a crafted file or web page containing malicious text rendering data. Victim must open the file or visit the webpage in vulnerable Firefox versions (< 149.0.2 or Firefox ESR < 140.9.1). No authentication required. Default Firefox installations affected.
Impact

Real-world risk is High based on converging threat indicators. CVSS 8.8 reflects network-based attack delivery (AV:N), low complexity (AC:L), and full confidentiality/integrity/availability impact (C:H/I:H/A:H), requiring only user interaction (UI:R) without authentication (PR:N). The unauthenticated network vector combined with user interaction aligns with typical web-based exploitation scenarios where attackers lure victims to malicious sites. While no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), the technical vulnerability class (integer overflow to buffer overflow in rendering engine) represents proven exploitation techniques used in browser exploits. Firefox's widespread deployment in enterprise and consumer environments amplifies exposure. The requirement for user interaction provides some mitigation, but phishing and social engineering make this barrier surmountable. Mozilla's rapid patch release (affecting two separate branches) suggests internal assessment of significant risk. Organizations should prioritize patching given the attack vector accessibility and potential for weaponization despite current absence of public exploit code.
Exploit ScenarioDerived

An attacker crafts a malicious webpage containing specially formatted text elements designed to trigger integer overflow conditions in Firefox's text rendering pipeline. When a victim browses to the attacker-controlled site or clicks a phishing link, the Graphics: Text component processes the malicious content, causing integer wraparound during memory allocation calculations. This results in undersized buffer allocation followed by out-of-bounds write operations, corrupting adjacent memory regions. The attacker leverages this memory corruption to overwrite critical data structures or inject executable code, achieving arbitrary code execution within the browser process context. From this position, the attacker can exfiltrate browser data including credentials, session tokens, and cached content, or pivot to further system compromise by exploiting additional browser sandbox escape vulnerabilities.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 07, 2026

Integer overflow in Firefox and Firefox ESR text rendering engine allows remote attackers to achieve arbitrary code execution via specially crafted web content. Affects Firefox versions prior to 149.0.2 and Firefox ESR prior to 140.9.1. Attack requires user interaction (visiting malicious webpage) but no authentication. CVSS 8.8 (High severity). No public exploit identified at time of analysis, though the vulnerability class (integer overflow leading to buffer overflow) is well-understood and exploitable.

RemediationAI

Vendor-released patch: Firefox 149.0.2 and Firefox ESR 140.9.1. Organizations should immediately upgrade Firefox installations to version 149.0.2 or later for standard release channel users, and Firefox ESR 140.9.1 or later for Extended Support Release deployments. Patches address the integer overflow condition in the Graphics: Text component through improved boundary checking and integer arithmetic validation. Updates can be obtained through Firefox's built-in automatic update mechanism, enterprise deployment tools (MSI/PKG installers), or direct download from Mozilla. No workarounds are available for this vulnerability; patching is the only effective remediation. Detailed patch information and deployment guidance available in Mozilla Foundation Security Advisories MFSA2026-25 (https://www.mozilla.org/security/advisories/mfsa2026-25/) and MFSA2026-27 (https://www.mozilla.org/security/advisories/mfsa2026-27/). Administrators should verify Firefox version compliance across endpoints using enterprise management tools or Firefox's about:support diagnostic page.

Affected VersionsENISA

Firefox ESR unspecified <140.9.1
Firefox unspecified <149.0.2

Affected Packages

euvd firefox_esr_unspecified fix: 140.9.1
euvd firefox_unspecified fix: 149.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability resides in Firefox's Graphics: Text component, which handles text layout, rendering, and typography operations in the browser engine. The issue is rooted in CWE-190 (Integer Overflow or Wraparound), where arithmetic operations on text processing parameters can exceed maximum representable values, leading to incorrect memory allocation sizes. When combined with improper boundary condition checks, this integer overflow can cascade into a buffer overflow condition. The Graphics: Text subsystem is critical for rendering all textual content in web pages, making it a high-value attack surface. Integer overflows in graphics rendering have historically been exploited to achieve memory corruption primitives that enable arbitrary code execution in the browser's security context.

Know when Firefox Esr gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.8 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch available
Apr 16, 2026 - 05:29 EUVD
140.9.1,149.0.2
CVE Published
Apr 07, 2026 - 12:43 nvd
HIGH 8.8

DescriptionCVE.org

Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability affects Firefox < 149.0.2 and Firefox ESR < 140.9.1.

Executive ViewAI

Why It Matters

CVE-2026-5732 is a high-severity integer overflow vulnerability in Firefox and Firefox ESR that enables remote code execution when users visit malicious webpages. This directly threatens any organization where Firefox is deployed as a standard or permitted browser, as exploitation requires only user interaction and no authentication. Immediate patching is critical to prevent potential compromise of employee endpoints and lateral network movement.

Business Impact: High
Compensating Controls

Apply vendor patch. Until patching is complete, implement network-level controls: restrict Firefox user access to whitelisted domains only, disable JavaScript execution where possible, deploy web filtering to block known malicious sites, and educate users to avoid untrusted websites. Monitor for suspicious Firefox process behavior (memory dumping, child process spawning).

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

More in Firefox Esr

View all
CVE-2015-4000 LOW POC
3.7 May 21

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro
CVE-2020-26950 HIGH POC
8.8 Dec 09

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable

CVE-2026-4689 CRITICAL POC
10.0 Mar 24

A sandbox escape vulnerability exists in Firefox's XPCOM component due to incorrect boundary conditions and integer over
CVE-2022-29917 CRITICAL POC
9.8 Dec 22

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bug
CVE-2014-1568 HIGH
7.5 Sep 25

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozi
CVE-2022-26384 CRITICAL POC
9.6 Dec 22

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scri
CVE-2022-34484 HIGH POC
8.8 Dec 22

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Rated high severity (CVSS 8.8)
CVE-2022-28281 HIGH POC
8.8 Dec 22

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent pr
CVE-2022-26381 HIGH POC
8.8 Dec 22

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploi
CVE-2022-22756 HIGH POC
8.8 Dec 22

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been
CVE-2022-22740 HIGH POC
8.8 Dec 22

Certain network request objects were freed too early when releasing a network request handle. Rated high severity (CVSS

CVE-2022-22738 HIGH POC
8.8 Dec 22

Applying a CSS filter effect could have accessed out of bounds memory. Rated high severity (CVSS 8.8), this vulnerabilit

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Liberty Linux 10 Fixed
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:7671 ADVISORY https://access.redhat.com/errata/RHSA-2026:7672 ADVISORY https://access.redhat.com/errata/RHSA-2026:8052 ADVISORY https://access.redhat.com/errata/RHSA-2026:8459 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5732 ADVISORY https://vuldb.com/vuln/355744 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1273/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1322/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1379/ REF https://access.redhat.com/errata/RHSA-2026:11805 REF https://access.redhat.com/errata/RHSA-2026:11813 REF https://access.redhat.com/errata/RHSA-2026:12264 REF https://access.redhat.com/errata/RHSA-2026:13342 REF https://access.redhat.com/errata/RHSA-2026:13412 REF https://access.redhat.com/errata/RHSA-2026:13533 REF https://access.redhat.com/errata/RHSA-2026:13582 REF https://access.redhat.com/errata/RHSA-2026:13583 REF https://access.redhat.com/errata/RHSA-2026:13596 REF https://access.redhat.com/errata/RHSA-2026:13600 REF https://access.redhat.com/errata/RHSA-2026:13665 REF https://access.redhat.com/errata/RHSA-2026:13682 REF https://access.redhat.com/errata/RHSA-2026:13683 REF https://access.redhat.com/errata/RHSA-2026:13922 REF https://access.redhat.com/errata/RHSA-2026:13977 REF https://access.redhat.com/errata/RHSA-2026:14223 REF https://access.redhat.com/errata/RHSA-2026:14303 REF https://access.redhat.com/errata/RHSA-2026:15889 REF https://access.redhat.com/errata/RHSA-2026:9345 REF https://access.redhat.com/errata/RHSA-2026:9638 REF https://access.redhat.com/security/cve/CVE-2026-5732 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2017867 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455908 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5732.json REF https://www.mozilla.org/security/advisories/mfsa2026-25/ REF https://www.mozilla.org/security/advisories/mfsa2026-27/ REF https://www.mozilla.org/security/advisories/mfsa2026-28/ REF https://www.mozilla.org/security/advisories/mfsa2026-29/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy