Firefox Esr EUVD-2026-19611

| CVE-2026-5732 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-04-07 mozilla

GHSA-mj57-mxq8-qvw9

Buffer Overflow Integer Overflow Mozilla Firefox Esr

8.8

CVSS 3.1 · Vendor: mozilla

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

User visits malicious webpage
Delivery

Browser renders crafted text element
Exploit

Integer overflow in Graphics Text component
Execution

Memory corruption occurs
Impact

Arbitrary code execution with user privileges

Vulnerability Assessment

Weakness	CWE CWE-190 ASVS 5.0 V15 - Secure Coding and Architecture Integer overflow checks MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Attacker sends a crafted file or web page containing malicious text rendering data. Victim must open the file or visit the webpage in vulnerable Firefox versions (< 149.0.2 or Firefox ESR < 140.9.1). No authentication required. Default Firefox installations affected.
Impact	Real-world risk is High based on converging threat indicators. CVSS 8.8 reflects network-based attack delivery (AV:N), low complexity (AC:L), and full confidentiality/integrity/availability impact (C:H/I:H/A:H), requiring only user interaction (UI:R) without authentication (PR:N). The unauthenticated network vector combined with user interaction aligns with typical web-based exploitation scenarios where attackers lure victims to malicious sites. While no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), the technical vulnerability class (integer overflow to buffer overflow in rendering engine) represents proven exploitation techniques used in browser exploits. Firefox's widespread deployment in enterprise and consumer environments amplifies exposure. The requirement for user interaction provides some mitigation, but phishing and social engineering make this barrier surmountable. Mozilla's rapid patch release (affecting two separate branches) suggests internal assessment of significant risk. Organizations should prioritize patching given the attack vector accessibility and potential for weaponization despite current absence of public exploit code.
Exploit ScenarioDerived	An attacker crafts a malicious webpage containing specially formatted text elements designed to trigger integer overflow conditions in Firefox's text rendering pipeline. When a victim browses to the attacker-controlled site or clicks a phishing link, the Graphics: Text component processes the malicious content, causing integer wraparound during memory allocation calculations. This results in undersized buffer allocation followed by out-of-bounds write operations, corrupting adjacent memory regions. The attacker leverages this memory corruption to overwrite critical data structures or inject executable code, achieving arbitrary code execution within the browser process context. From this position, the attacker can exfiltrate browser data including credentials, session tokens, and cached content, or pivot to further system compromise by exploiting additional browser sandbox escape vulnerabilities.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

AnalysisAIv1 – Apr 07, 2026

Integer overflow in Firefox and Firefox ESR text rendering engine allows remote attackers to achieve arbitrary code execution via specially crafted web content. Affects Firefox versions prior to 149.0.2 and Firefox ESR prior to 140.9.1. Attack requires user interaction (visiting malicious webpage) but no authentication. CVSS 8.8 (High severity). No public exploit identified at time of analysis, though the vulnerability class (integer overflow leading to buffer overflow) is well-understood and exploitable.

RemediationAI

Vendor-released patch: Firefox 149.0.2 and Firefox ESR 140.9.1. Organizations should immediately upgrade Firefox installations to version 149.0.2 or later for standard release channel users, and Firefox ESR 140.9.1 or later for Extended Support Release deployments. Patches address the integer overflow condition in the Graphics: Text component through improved boundary checking and integer arithmetic validation. Updates can be obtained through Firefox's built-in automatic update mechanism, enterprise deployment tools (MSI/PKG installers), or direct download from Mozilla. No workarounds are available for this vulnerability; patching is the only effective remediation. Detailed patch information and deployment guidance available in Mozilla Foundation Security Advisories MFSA2026-25 (https://www.mozilla.org/security/advisories/mfsa2026-25/) and MFSA2026-27 (https://www.mozilla.org/security/advisories/mfsa2026-27/). Administrators should verify Firefox version compliance across endpoints using enterprise management tools or Firefox's about:support diagnostic page.

Affected VersionsENISA

Firefox ESR unspecified <140.9.1

Firefox unspecified <149.0.2

Affected Packages

euvd firefox_esr_unspecified fix: 140.9.1

euvd firefox_unspecified fix: 149.0.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Technical ContextAI · show details

This vulnerability resides in Firefox's Graphics: Text component, which handles text layout, rendering, and typography operations in the browser engine. The issue is rooted in CWE-190 (Integer Overflow or Wraparound), where arithmetic operations on text processing parameters can exceed maximum representable values, leading to incorrect memory allocation sizes. When combined with improper boundary condition checks, this integer overflow can cascade into a buffer overflow condition. The Graphics: Text subsystem is critical for rendering all textual content in web pages, making it a high-value attack surface. Integer overflows in graphics rendering have historically been exploited to achieve memory corruption primitives that enable arbitrary code execution in the browser's security context.

Know when Firefox Esr gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mozilla) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 8.8 HIGH

Primary rating from Vendor (mozilla).

CVSS VectorVendor: mozilla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

2

Patch available

Apr 16, 2026 - 05:29 EUVD

140.9.1,149.0.2

CVE Published

Apr 07, 2026 - 12:43 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect boundary conditions, integer overflow in the Graphics: Text component. This vulnerability affects Firefox < 149.0.2 and Firefox ESR < 140.9.1.

Executive ViewAI

Why It Matters

CVE-2026-5732 is a high-severity integer overflow vulnerability in Firefox and Firefox ESR that enables remote code execution when users visit malicious webpages. This directly threatens any organization where Firefox is deployed as a standard or permitted browser, as exploitation requires only user interaction and no authentication. Immediate patching is critical to prevent potential compromise of employee endpoints and lateral network movement.

Business Impact: High

Compensating Controls

Apply vendor patch. Until patching is complete, implement network-level controls: restrict Firefox user access to whitelisted domains only, disable JavaScript execution where possible, deploy web filtering to block known malicious sites, and educate users to avoid untrusted websites. Monitor for suspicious Firefox process behavior (memory dumping, child process spawning).

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Data Quality

7 sources

Confidence: High

EUVD

CVE.org

EPSS

Vulnrichment Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

No

Human Impact

High

Technical Impact

Total

Priority Score

44

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Integer Overflow MEDIUM

Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.

More in Firefox Esr

View all

CVE-2015-4000 LOW Monitor POC

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pro

CVE-2020-26950 HIGH Act Now POC

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable

CVE-2026-4689 CRITICAL Act Now POC

A sandbox escape vulnerability exists in Firefox's XPCOM component due to incorrect boundary conditions and integer over

CVE-2022-29917 CRITICAL Act Now POC

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bug

CVE-2014-1568 HIGH Act Now

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozi

CVE-2022-26384 CRITICAL Act Now POC

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scri

CVE-2022-34484 HIGH This Week POC

The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Rated high severity (CVSS 8.8)

CVE-2022-28281 HIGH This Week POC

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent pr

CVE-2022-26381 HIGH This Week POC

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploi

CVE-2022-22756 HIGH This Week POC

If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been

CVE-2022-22740 HIGH This Week POC

Certain network request objects were freed too early when releasing a network request handle. Rated high severity (CVSS

CVE-2022-22738 HIGH This Week POC

Applying a CSS filter effect could have accessed out of bounds memory. Rated high severity (CVSS 8.8), this vulnerabilit

Same weakness CWE-190 – Integer Overflow or Wraparound

View all

CVE-2013-2729 CRITICAL POC

CVE-2015-8651 HIGH

CVE-2012-5054 HIGH POC

CVE-2014-0569 CRITICAL POC

CVE-2023-21716 CRITICAL POC

CVE-2017-3599 HIGH POC

CVE-2017-7529 HIGH

CVE-2016-1010 HIGH

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2015-3113 CRITICAL POC

CVE-2011-2462 CRITICAL POC

CVE-2020-0796 CRITICAL POC

CVE-2019-11043 CRITICAL POC

CVE-2009-0927 HIGH POC

CVE-2012-1889 HIGH POC

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Liberty Linux 10	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed

References

Advisories & patches

ADVISORY https://access.redhat.com/errata/RHSA-2026:7671 ADVISORY https://access.redhat.com/errata/RHSA-2026:7672 ADVISORY https://access.redhat.com/errata/RHSA-2026:8052 ADVISORY https://access.redhat.com/errata/RHSA-2026:8459 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5732 ADVISORY https://vuldb.com/vuln/355744 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1273/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1322/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1379/ REF https://access.redhat.com/errata/RHSA-2026:11805 REF https://access.redhat.com/errata/RHSA-2026:11813 REF https://access.redhat.com/errata/RHSA-2026:12264 REF https://access.redhat.com/errata/RHSA-2026:13342 REF https://access.redhat.com/errata/RHSA-2026:13412 REF https://access.redhat.com/errata/RHSA-2026:13533 REF https://access.redhat.com/errata/RHSA-2026:13582 REF https://access.redhat.com/errata/RHSA-2026:13583 REF https://access.redhat.com/errata/RHSA-2026:13596 REF https://access.redhat.com/errata/RHSA-2026:13600 REF https://access.redhat.com/errata/RHSA-2026:13665 REF https://access.redhat.com/errata/RHSA-2026:13682 REF https://access.redhat.com/errata/RHSA-2026:13683 REF https://access.redhat.com/errata/RHSA-2026:13922 REF https://access.redhat.com/errata/RHSA-2026:13977 REF https://access.redhat.com/errata/RHSA-2026:14223 REF https://access.redhat.com/errata/RHSA-2026:14303 REF https://access.redhat.com/errata/RHSA-2026:15889 REF https://access.redhat.com/errata/RHSA-2026:9345 REF https://access.redhat.com/errata/RHSA-2026:9638 REF https://access.redhat.com/security/cve/CVE-2026-5732 REF https://bugzilla.mozilla.org/show_bug.cgi?id=2017867 REF https://bugzilla.redhat.com/show_bug.cgi?id=2455908 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5732.json REF https://www.mozilla.org/security/advisories/mfsa2026-25/ REF https://www.mozilla.org/security/advisories/mfsa2026-27/ REF https://www.mozilla.org/security/advisories/mfsa2026-28/ REF https://www.mozilla.org/security/advisories/mfsa2026-29/

Search Externally

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy