Firefox Esr CVE-2026-5734

|

EUVD

EUVD-2026-19614 CRITICAL

Out-of-bounds Write (CWE-787)

2026-04-07 mozilla

RCE Buffer Overflow Memory Corruption Mozilla Firefox Esr

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send malicious content to Firefox
Exploit

Trigger memory safety bug in parser
Execution

Corrupt memory region
Impact

Execute arbitrary code with browser privileges

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Remote unauthenticated attacker. The victim must open a crafted web page or email in Firefox versions < 149.0.2 or Firefox ESR < 140.9.1, or Thunderbird < 149.0.1 or ESR < 140.9.1. No special configuration required; default installations are vulnerable.
Impact	This represents a genuine critical-severity threat despite no confirmed active exploitation. The CVSS 9.8 score is justified by the attack vector (AV:N - network accessible via malicious websites), low complexity (AC:L - no special conditions required), no authentication requirement (PR:N), no user interaction beyond normal browsing (UI:N), and full impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The CVSS scoring aligns with real-world risk: browsers are ubiquitous attack surfaces, and memory corruption bugs are proven pathways to remote code execution. While no EPSS score is provided and the vulnerability is not listed in CISA KEV (indicating no confirmed exploitation in the wild), the combination of critical CVSS, public disclosure with patch availability, and Mozilla's explicit statement that bugs could be exploited for arbitrary code execution makes this a high-priority remediation target. The lack of public POC currently reduces immediate risk, but Firefox's popularity and the detailed bug tracker references may accelerate exploit development. Organizations should treat this as automatable (once weaponized) with mission-critical technical impact given the potential for complete system compromise through browser exploitation.
Exploit ScenarioDerived	An attacker crafts a malicious website containing specially formatted content (JavaScript, HTML, media elements, or WebAssembly) designed to trigger one of the memory corruption bugs in Firefox's rendering engine. When a victim using an unpatched Firefox version (< 149.0.2) or Firefox ESR (< 140.9.1) navigates to the malicious page through normal browsing activity-clicking a link in email, social media, or search results-the out-of-bounds write condition corrupts browser memory. The attacker leverages this memory corruption to hijack program execution flow and inject arbitrary code running with the victim's user privileges, enabling data exfiltration, credential theft, malware installation, or lateral movement within corporate networks. No authentication is required and the attack complexity is low, requiring only that the victim visit the attacker-controlled URL.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Apr 07, 2026

Multiple memory corruption vulnerabilities in Mozilla Firefox (< 149.0.2) and Firefox ESR (< 140.9.1) enable unauthenticated remote code execution with critical CVSS 9.8 severity. These memory safety bugs-including CWE-787 out-of-bounds write issues-affect both standard and Extended Support Release channels, with Mozilla confirming evidence of memory corruption exploitable for arbitrary code execution. No active exploitation confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though CVSS vector indicates network-accessible attack requiring no user interaction.

RemediationAI

Immediately upgrade to Firefox version 149.0.2 or later for standard release channel users, and Firefox ESR version 140.9.1 or later for Extended Support Release deployments. Mozilla has released vendor-patched versions addressing all identified memory safety bugs. Download updates through Firefox's built-in update mechanism (Menu > Help > About Firefox triggers automatic update check) or obtain installers directly from mozilla.org. Consult Mozilla Foundation Security Advisories MFSA2026-25 (https://www.mozilla.org/security/advisories/mfsa2026-25/) and MFSA2026-27 (https://www.mozilla.org/security/advisories/mfsa2026-27/) for complete remediation guidance. For enterprise environments using Firefox ESR, prioritize rapid deployment of version 140.9.1 through existing software distribution mechanisms. No effective workarounds exist for memory corruption vulnerabilities of this nature; patching is the only reliable mitigation. Organizations unable to patch immediately should consider temporary browser restrictions or network-layer controls to limit exposure to untrusted web content until upgrades complete.

Affected VersionsENISA

Firefox unspecified <149.0.2

Firefox ESR unspecified <140.9.1

Affected Packages

euvd firefox_esr_unspecified fix: 140.9.1

euvd firefox_unspecified fix: 149.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

This vulnerability represents a collection of memory safety bugs in Firefox's core browser engine (Gecko), specifically affecting Firefox 149.0.1, Firefox ESR 140.9.0, Thunderbird 149.0.1, and Thunderbird ESR 140.9.0. The root cause class is CWE-787 (Out-of-bounds Write), a critical memory corruption vulnerability that occurs when software writes data past the end of an allocated buffer. Mozilla's Bugzilla tracking shows eight distinct bug IDs (2022369, 2023026, 2023545, 2023555, 2023958, 2025422, 2025468, 2025492, 2025505), suggesting multiple distinct memory safety issues discovered through Firefox's ongoing security audit processes. The CPE identifiers confirm impact to both mozilla:firefox and mozilla:firefox_esr product lines. Memory corruption in browser engines is particularly severe because browsers process untrusted content from the web, making them prime targets for exploitation through malicious web pages, JavaScript, or media content.

Know when Firefox Esr gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat 8.8 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

2

Patch available

Apr 16, 2026 - 05:29 EUVD

149.0.2,140.9.1

CVE Published

Apr 07, 2026 - 12:43 nvd

CRITICAL 9.8

DescriptionNVD

Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149.0.2 and Firefox ESR < 140.9.1.

Executive ViewAI

Why It Matters

Critical memory corruption vulnerabilities in Mozilla Firefox and Firefox ESR allow unauthenticated remote code execution on affected systems with no user interaction required. Firefox versions below 149.0.2 and Firefox ESR versions below 140.9.1 are exposed to arbitrary code execution via network-based attacks, creating immediate risk to all organizational endpoints running vulnerable browser versions.

Business Impact: Severe

Compensating Controls

Apply vendor patch. Until patching is complete: restrict Firefox usage to sandboxed environments where possible, implement network-level controls to block outbound connections from browser processes, disable plugins and extensions, and consider temporary deployment of alternative browsers for critical workflows.

Threat Intelligence Overview

EPSS Score

0.0%

Top 86% exploitable

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact

Very High

Technical Impact

Total

Priority Score

49

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Related Vulnerabilities in Firefox Memory Safety Issues

View all 3

CVE-2026-5735 CRITICAL

CVE-2026-5731 CRITICAL

More in Firefox Esr

View all

CVE-2015-4000 LOW Monitor POC

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2020-26950 HIGH Act Now POC

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable

CVE-2026-4689 CRITICAL Act Now POC

A sandbox escape vulnerability exists in Firefox's XPCOM component due to incorrect boundary conditions and integer over

CVE-2022-29917 CRITICAL Act Now POC

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bug

CVE-2014-1568 HIGH Act Now

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozi

CVE-2022-26384 CRITICAL Act Now POC

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scri

CVE-2022-34484 HIGH This Week POC

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Rated high severity (CVSS 8.8)

CVE-2022-28281 HIGH This Week POC

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent pr

CVE-2022-26381 HIGH This Week POC

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploi

CVE-2022-22756 HIGH This Week POC

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been

CVE-2022-22740 HIGH This Week POC

Certain network request objects were freed too early when releasing a network request handle. Rated high severity (CVSS

CVE-2022-22738 HIGH This Week POC

Applying a CSS filter effect could have accessed out of bounds memory. Rated high severity (CVSS 8.8), this vulnerabilit

Same weakness CWE-787 – Out-of-bounds Write

View all

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2012-1889 HIGH POC

CVE-2010-3333 HIGH POC

CVE-2014-1761 HIGH POC

CVE-2009-3129 HIGH POC

CVE-2021-1732 HIGH POC

CVE-2013-3346 CRITICAL POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Liberty Linux 10	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:7671 ADVISORY https://access.redhat.com/errata/RHSA-2026:7672 ADVISORY https://access.redhat.com/errata/RHSA-2026:8052 ADVISORY https://access.redhat.com/errata/RHSA-2026:8459 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5734 ADVISORY https://vuldb.com/vuln/355740 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1273/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1322/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1379/ REF https://access.redhat.com/errata/RHSA-2026:11805 REF https://access.redhat.com/errata/RHSA-2026:11813 REF https://access.redhat.com/errata/RHSA-2026:12264 REF https://access.redhat.com/errata/RHSA-2026:13342 REF https://access.redhat.com/errata/RHSA-2026:13412 REF https://access.redhat.com/errata/RHSA-2026:13533 REF https://access.redhat.com/errata/RHSA-2026:13582 REF https://access.redhat.com/errata/RHSA-2026:13583 REF https://access.redhat.com/errata/RHSA-2026:13596 REF https://access.redhat.com/errata/RHSA-2026:13600 REF https://access.redhat.com/errata/RHSA-2026:13665 REF https://access.redhat.com/errata/RHSA-2026:13682 REF https://access.redhat.com/errata/RHSA-2026:13683 REF https://access.redhat.com/errata/RHSA-2026:13922 REF https://access.redhat.com/errata/RHSA-2026:13977 REF https://access.redhat.com/errata/RHSA-2026:14223 REF https://access.redhat.com/errata/RHSA-2026:14303 REF https://access.redhat.com/errata/RHSA-2026:15889 REF https://access.redhat.com/errata/RHSA-2026:9345 REF https://access.redhat.com/errata/RHSA-2026:9638 REF https://access.redhat.com/security/cve/CVE-2026-5734 REF https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022369%2C2023026%2C2023545%2C2023555%2C2023958%2C2025422%2C2025468%2C2025492%2C2025505 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455897 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5734.json REF https://www.mozilla.org/security/advisories/mfsa2026-25/ REF https://www.mozilla.org/security/advisories/mfsa2026-27/ REF https://www.mozilla.org/security/advisories/mfsa2026-28/ REF https://www.mozilla.org/security/advisories/mfsa2026-29/

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy