by Kastro
Paper/Archive/CVE-2026-74987

CVE-2026-74987

Mozilla Firefox — Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.7.537 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Affected

ProductAffectedFixed inSource
Firefoxsee advisory140.14CNA
Thunderbirdsee advisory140.14CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.mozilla.org/buglist.cgi?bug_id=1500946%2C1788109%2C2045379%2C2045380%2C2049339%2C2049393%2C2053580%2C2054662%2C2054665%2C2054673%2C2054785%2C2058645refbugzilla.mozilla.org/buglist.cgi?bug_id=2048797%2C2050536%2C2053272%2C2053579%2C2057115%2C2057116%2C2057130%2C2057991%2C2057995%2C2058002%2C2058008%2C2058032%2C2058102%2C2058667refbugzilla.mozilla.org/show_bug.cgi?id=2059424refmozilla.org/security/advisories/mfsa2026-74refmozilla.org/security/advisories/mfsa2026-76refmozilla.org/security/advisories/mfsa2026-77refmozilla.org/security/advisories/mfsa2026-78refmozilla.org/security/advisories/mfsa2026-79refmozilla.org/security/advisories/mfsa2026-80