CVE-2026-7323

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

View on CVE.org
Published Apr 28, 2026 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Description
Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

Analysis

AI-generated

Technical impact

The updated description indicates that the vulnerability involves memory safety bugs that caused memory corruption in Firefox ESR 140.10.0, Firefox 150.0.0, Thunderbird ESR 140.10.0, and Thunderbird 150.0.0. The description notes that these bugs show evidence of memory corruption and, with sufficient effort, could be exploited to run arbitrary code. The fixes in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1 remove the vulnerable code paths.

Affected Systems

Affected versions include Firefox ESR 140.10.0, Firefox 150.0.0, Thunderbird ESR 140.10.0, and Thunderbird 150.0.0. The fix reached Firefox ESR 140.10.1, Firefox 150.0.1, Thunderbird ESR 140.10.1, and Thunderbird 150.0.1.

Risk and Exploitability

Memory corruption can lead to remote code execution. The CVSS score is 7.3 and the EPSS score is less than 1%, with the vulnerability not listed in KEV. The likely attack vector is inferred to be via malicious content—such as web pages or email attachments—that the vulnerable software processes, given that memory safety bugs often become exploitable through user interaction with such content. While no public exploit is documented, the potential severity remains high if an attacker can trigger the corrupting code paths.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to ESR 140.10.1 or the latest 150.0.1 release
  • Upgrade Thunderbird to ESR 140.10.1 or the latest 150.0.1 release
  • Enable security defaults and appropriate content blocking settings to reduce malicious content reaching vulnerable code paths
  • Disable or limit third‑party extensions that may trigger vulnerable code paths

Generated by OpenCVE AI on May 7, 2026 at 17:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4555-1 firefox-esr security update
Debian DLA Debian DLA DLA-4562-1 thunderbird security update
Debian DSA Debian DSA DSA-6236-1 firefox-esr security update
Debian DSA Debian DSA DSA-6242-1 thunderbird security update
References
Link Providers
https://access.redhat.com/errata/RHSA-2026:19153 cve-icon
https://access.redhat.com/errata/RHSA-2026:19157 cve-icon
https://access.redhat.com/errata/RHSA-2026:19348 cve-icon
https://access.redhat.com/errata/RHSA-2026:19370 cve-icon
https://access.redhat.com/errata/RHSA-2026:19588 cve-icon
https://access.redhat.com/errata/RHSA-2026:20586 cve-icon
https://access.redhat.com/errata/RHSA-2026:21743 cve-icon
https://access.redhat.com/errata/RHSA-2026:22324 cve-icon
https://access.redhat.com/errata/RHSA-2026:22408 cve-icon
https://access.redhat.com/errata/RHSA-2026:22409 cve-icon
https://access.redhat.com/errata/RHSA-2026:22410 cve-icon
https://access.redhat.com/errata/RHSA-2026:22708 cve-icon
https://access.redhat.com/errata/RHSA-2026:22712 cve-icon
https://access.redhat.com/errata/RHSA-2026:22847 cve-icon
https://access.redhat.com/errata/RHSA-2026:24345 cve-icon
https://access.redhat.com/errata/RHSA-2026:24717 cve-icon
https://access.redhat.com/errata/RHSA-2026:24718 cve-icon
https://access.redhat.com/errata/RHSA-2026:24719 cve-icon
https://access.redhat.com/errata/RHSA-2026:24721 cve-icon
https://access.redhat.com/errata/RHSA-2026:24844 cve-icon
https://access.redhat.com/errata/RHSA-2026:24846 cve-icon
https://access.redhat.com/errata/RHSA-2026:25014 cve-icon
https://access.redhat.com/security/cve/CVE-2026-7323 cve-icon
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2028537%2C2029911%2C2031121%2C2033602 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2463481 cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-7323 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7323.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-7323 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-35/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-36/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-36/#CVE-2026-7323 cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-38/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-39/ cve-icon cve-icon
https://www.mozilla.org/security/advisories/mfsa2026-39/#CVE-2026-7323 cve-icon
History
Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 140.10.0 and Firefox 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1. Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
Title Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1
Type Values Removed Values Added
Description Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1. Memory safety bugs present in Firefox ESR 140.10.0 and Firefox 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
Title Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1
Type Values Removed Values Added
First Time appeared Mozilla thunderbird
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla thunderbird
Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 140.10.0 and Firefox 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Firefox ESR 140.10.1. Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
Title Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Firefox ESR 140.10.1. Memory safety bugs present in Firefox ESR 140.10.0 and Firefox 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Firefox ESR 140.10.1.
Title Memory safety bugs fixed in Firefox ESR 140.10.1, Thunderbird ESR 140.10.1, Firefox 150.0.1 and Thunderbird 150.0.1 Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1
Type Values Removed Values Added
Weaknesses CWE-119
CWE-787
Metrics cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox
Type Values Removed Values Added
Description Memory safety bugs present in Firefox ESR 140.10.0, Thunderbird ESR 140.10.0, Firefox 150.0.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Firefox ESR 140.10.1.
Title Memory safety bugs fixed in Firefox ESR 140.10.1, Thunderbird ESR 140.10.1, Firefox 150.0.1 and Thunderbird 150.0.1
References
Earlier changes (5)
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-787

    Out-of-bounds Write

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Jul 15, 2026, 12:40 AM
Reserved
Apr 28, 2026, 1:42 PM

View source JSON

Updated
Jul 15, 2026, 12:40 AM

JSON

Status
Modified
Published
Apr 28, 2026, 3:16 PM
Modified
Oct 26, 2026, 12:10 AM

View source JSON

Severity
Important
Public date
Apr 28, 2026, 1:49 PM

View source Bugzilla JSON

Updated
May 7, 2026, 5:45 PM

JSON