What is the CVSS score of CVE-2026-8975?

CVE-2026-8975 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Mozilla Firefox are affected by CVE-2026-8975?

Mozilla Firefox (versions 150, ESR 115.35, and ESR 140.10) contains a critical memory corruption vulnerability enabling arbitrary code execution when users visit malicious websites.. A patch is available.

How to fix or mitigate CVE-2026-8975?

Within 24 hours: Inventory all Firefox installations organization-wide; disable JavaScript execution or restrict untrusted website access; communicate advisory to all users. Within 7 days: Deploy endpoint detection and response (EDR) monitoring for anomalous process execution; evaluate alternative browsers (Chrome, Edge) for critical business activities. Within 30 days: Apply Mozilla patch immediately upon availability (monitor Mozilla Security Center for releases fixing CVE-2026-8975 in Firefox >150 and ESR >140.10); verify 100% deployment coverage before resuming standard browser usage.

Mozilla Firefox CVE-2026-8975

EUVD-2026-30926 HIGH

Buffer Overflow (CWE-119)

2026-05-19 mozilla

GHSA-v6hv-5rrm-2f28

Mozilla Buffer Overflow RCE

8.8

CVSS 3.1 · Vendor: mozilla

Severity by source

Vendor (mozilla) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 17:28 vuln.today

Severity Changed

May 20, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

May 20, 2026 - 17:22 NVD

9.8 (CRITICAL) 8.8 (HIGH)

CVE Published

May 19, 2026 - 12:30 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11.

AnalysisAI

Memory corruption in Mozilla Firefox 150 and Firefox ESR (115.35, 140.10) allows remote attackers to potentially execute arbitrary code when a user visits a crafted web page. The flaws stem from memory safety bugs reported by Mozilla developers, some showing evidence of exploitable memory corruption. No public exploit identified at time of analysis, and EPSS scoring (0.06%) suggests low near-term exploitation likelihood despite the high CVSS rating.

Technical ContextAI

The vulnerability resides in Mozilla Firefox's browser engine (Gecko/SpiderMonkey components), as identified by CPE cpe:2.3:a:mozilla:firefox. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) covers classic memory safety issues such as buffer overflows, out-of-bounds reads/writes, and use-after-free conditions in C/C++ code. Browsers process untrusted content (HTML, JavaScript, images, fonts, WebAssembly) through complex parsers and JIT compilers, providing a large attack surface where memory corruption can be triggered by malicious web content and potentially escalated to arbitrary code execution within the content process sandbox.

RemediationAI

Vendor-released patch: upgrade to Firefox 151, Firefox ESR 115.36, or Firefox ESR 140.11 depending on the deployment channel, as confirmed in Mozilla advisories mfsa2026-46 through mfsa2026-51 (https://www.mozilla.org/security/advisories/). Enterprise environments using the ESR channel should select the matching ESR fix to avoid feature regressions while obtaining the security update. Until patches are deployed, compensating controls include restricting browsing to trusted sites via web proxy/URL filtering, enabling strict content blocking and enhanced tracking protection in Firefox preferences (which limits exposure to third-party scripts at the cost of breaking some sites), and ensuring the OS-level sandbox and exploit mitigations (e.g., Windows Defender Exploit Guard, macOS Gatekeeper, Linux seccomp) remain enabled to raise the bar against successful memory-corruption exploitation.

More in Mozilla

View all

CVE-2015-4495 HIGH Act Now POC

8.8 Aug 08

The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote

CVE-2013-1690 HIGH Act Now POC

8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2013-0753 CRITICAL Act Now POC

9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2013-1710 CRITICAL Emergency POC

10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2014-1511 CRITICAL Emergency POC

9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo

CVE-2013-0643 HIGH Act Now

8.8 Feb 27

The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and b

Same weakness CWE-119 – Buffer Overflow

View all

CVE-2017-11882 HIGH POC

7.8

CVE-2014-6332 HIGH POC

8.8

CVE-2023-4966 CRITICAL POC

9.4

CVE-2015-2426 HIGH POC

8.8

CVE-2013-3918 HIGH POC

8.8

CVE-2017-11774 HIGH POC

7.8

CVE-2013-3660 HIGH POC

7.8

CVE-2017-6736 HIGH POC

8.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Server 12 SP5-LTSS	Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-8975 vulnerability details – vuln.today

Back

Mozilla Firefox CVE-2026-8975

Severity by source

CVSS VectorVendor: mozilla

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Mozilla

Same weakness CWE-119 – Buffer Overflow

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code