QSearchQSearch

CVE-2026-8974

8.8 HIGH

Memory safety bugs present in Firefox ESR 140.10 and Firefox 150

Published: 2026-05-19 · Last updated: 2026-05-26

Severity and scoring

CVSS
8.8 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE
CWE-119

Affected products

VendorProduct
mozillafirefox, thunderbird

Description

Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-12330 — Incorrect boundary conditions in the Internationalization component (5.4 MEDIUM)
  • CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
  • CVE-2026-12328 — Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151 (8.1 HIGH)
  • CVE-2026-12323 — Spoofing issue in the DOM: Core & HTML component (5.4 MEDIUM)
  • CVE-2026-12322 — Clickjacking issue in the Widget: Gtk component (5.4 MEDIUM)

Same CWE

  • CVE-2026-12330 — Incorrect boundary conditions in the Internationalization component (5.4 MEDIUM)
  • CVE-2026-12329 — Memory safety bug fixed in Thunderbird ESR 140.12 (5.3 MEDIUM)
  • CVE-2026-12327 — Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151 (7.3 HIGH)
  • CVE-2026-12326 — Memory safety bugs present in Firefox 151 and Thunderbird 151 (7.3 HIGH)
  • CVE-2026-12318 — Incorrect boundary conditions in the Libraries component in NSS (7.3 HIGH)