by Kastro
Paper/Archive/CVE-2026-74940

CVE-2026-74940

Mozilla Firefox — Use-after-free in the Graphics: Text component

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 49.0.490 × 209.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory115.39CNA
Thunderbirdsee advisory140.14CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/show_bug.cgi?id=2054842refmozilla.org/security/advisories/mfsa2026-74refmozilla.org/security/advisories/mfsa2026-75refmozilla.org/security/advisories/mfsa2026-76refmozilla.org/security/advisories/mfsa2026-77refmozilla.org/security/advisories/mfsa2026-78refmozilla.org/security/advisories/mfsa2026-79refmozilla.org/security/advisories/mfsa2026-80