What is the CVSS score of CVE-2026-8974?

CVE-2026-8974 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mozilla Firefox are affected by CVE-2026-8974?

Memory corruption in Mozilla Firefox 150 and ESR 140.10 enables attackers to gain full control of end-user computers when employees visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-8974?

Within 24 hours: Issue urgent security advisory and notify IT/helpdesk of mandatory Firefox update requirement; audit current Firefox deployment. Within 7 days: Deploy Firefox 151 (or Firefox ESR 140.11 for ESR users) to all endpoints via patch management; verify completion through compliance scanning. Within 30 days: Conduct final audit of Firefox versions across all systems; implement endpoint policies to restrict versions 150 and ESR 140.10.

Mozilla Firefox CVE-2026-8974

EUVD-2026-30922 HIGH

Buffer Overflow (CWE-119)

2026-05-19 mozilla

GHSA-c792-chx5-8443

Mozilla Buffer Overflow RCE

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

6.1 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:27 vuln.today

Severity Changed

May 20, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

May 20, 2026 - 17:22 NVD

9.8 (CRITICAL) 8.8 (HIGH)

CVE Published

May 19, 2026 - 12:30 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.

AnalysisAI

Memory corruption in Mozilla Firefox 150 and Firefox ESR 140.10 allows remote attackers to potentially execute arbitrary code when a victim visits a crafted web page. The flaw stems from multiple memory safety bugs reported by Mozilla developers, with some showing evidence of exploitable memory corruption; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.05%, 14th percentile). Mozilla has shipped fixes in Firefox 151 and Firefox ESR 140.11.

Technical ContextAI

The vulnerability covers a broad set of memory safety bugs (CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer) discovered across the Gecko browser engine and its C/C++ subsystems used by Firefox. CWE-119 issues typically involve out-of-bounds reads/writes, heap or stack buffer overflows, and use-after-free conditions in components such as the JavaScript engine, layout, graphics, media, and IPC layers. CPE data confirms the affected product is cpe:2.3:a:mozilla:firefox, and the linked Bugzilla buglist enumerates dozens of underlying bugs rolled up into this aggregate advisory, which is Mozilla's customary practice for releases.

RemediationAI

Vendor-released patch: upgrade to Firefox 151 or Firefox ESR 140.11, which Mozilla explicitly identifies as containing the fixes per advisories MFSA2026-46/48/50/51 (https://www.mozilla.org/security/advisories/mfsa2026-50/ and /mfsa2026-51/). Managed endpoints should be updated via the standard Firefox update channel or enterprise policy; ESR users on the 140 line must move to 140.11 rather than jumping to mainline 151 if extended-support stability is required. No workaround is provided by the vendor; as compensating controls until patching completes, consider restricting browsing of untrusted sites from sensitive workstations, enforcing strict site isolation and sandboxing (already on by default in Firefox), and deploying network-layer URL filtering to block known-malicious content - recognizing these reduce but do not eliminate drive-by risk and add operational friction.

More in Mozilla

View all

CVE-2015-4495 HIGH Act Now POC

8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

CVE-2013-1690 HIGH Act Now POC

8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2013-0753 CRITICAL Act Now POC

9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2013-1710 CRITICAL Emergency POC

10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2014-1511 CRITICAL Emergency POC

9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo

CVE-2013-0643 HIGH Act Now

8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-119 – Buffer Overflow

View all

CVE-2017-11882 HIGH POC

7.8

CVE-2014-6332 HIGH POC

8.8

CVE-2023-4966 CRITICAL POC

9.4

CVE-2015-2426 HIGH POC

8.8

CVE-2013-3918 HIGH POC

8.8

CVE-2017-11774 HIGH POC

7.8

CVE-2013-3660 HIGH POC

7.8

CVE-2017-6736 HIGH POC

8.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-8974 vulnerability details – vuln.today

Back

Mozilla Firefox CVE-2026-8974

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mozilla

Same weakness CWE-119 – Buffer Overflow

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code