Log in Start free

Vulnerability · Published Apr 21, 2026 · Assigned by mozilla

CVE-2026-6786Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150

High 7.5

In plain English

A high-severity use-after-free in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 57.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10firefox140.10.0-1.el10_1ALSA-2026:10767
AlmaLinux:8firefox140.10.0-1.el8_10.alma.1ALSA-2026:10766
AlmaLinux:9firefox140.10.0-1.el9_7.alma.1ALSA-2026:10757
AlmaLinux:9firefox-x11140.10.0-1.el9_7.alma.1ALSA-2026:10757
AlmaLinux:10thunderbird140.10.0-1.el10_1.alma.1ALSA-2026:12285
AlmaLinux:8thunderbird140.10.0-1.el8_10.alma.1ALSA-2026:13537
AlmaLinux:9thunderbird140.10.0-1.el9_7.alma.1ALSA-2026:15892
AlmaLinux:9thunderbird140.10.1-1.el9_8.alma.1ALSA-2026:19348
Debian:12firefox-esr140.10.0esr-1~deb12u1DEBIAN-CVE-2026-6786
Debian:13firefox-esr140.10.0esr-1~deb13u1DEBIAN-CVE-2026-6786
Debian:14firefox-esr140.10.0esr-1DEBIAN-CVE-2026-6786
Debian:12thunderbird1:140.10.0esr-1~deb12u1DEBIAN-CVE-2026-6786
Debian:13thunderbird1:140.10.0esr-1~deb13u1DEBIAN-CVE-2026-6786
Debian:14thunderbird1:140.10.0esr-1DEBIAN-CVE-2026-6786
Rocky Linux:10firefox0:140.10.0-1.el10_1RLSA-2026:10767
Rocky Linux:8firefox0:140.10.0-1.el8_10RLSA-2026:10766
Rocky Linux:9firefox0:140.10.0-1.el9_7RLSA-2026:19201
Rocky Linux:9firefox0:140.10.0-1.el9_7RLSA-2026:10757
Rocky Linux:10thunderbird0:140.10.0-1.el10_1RLSA-2026:12285
Rocky Linux:8thunderbird0:140.10.0-1.el8_10RLSA-2026:13537
Rocky Linux:9thunderbird0:140.10.1-1.el9_8RLSA-2026:19348
Rocky Linux:9thunderbird0:140.10.0-1.el9_7RLSA-2026:15892
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2026-6786
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2026-6786
Ubuntu:24.04:LTSmozjs115no fix listedUBUNTU-CVE-2026-6786
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2026-6786
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2026-6786
Ubuntu:22.04:LTSthunderbirdno fix listedUBUNTU-CVE-2026-6786

Affected products (as reported)

VendorProductVersions
Mozilla Firefox see references
Mozilla Thunderbird see references

Weakness: CWE-416, CWE-125, CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References