CVE-2026-74948

Information disclosure in the Graphics component

Published Aug 18, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Analysis

Technical impact

A flaw in the graphics subsystem of Mozilla Firefox and Thunderbird allows the graphics component to read and expose data that should remain private. The weakness corresponds to information exposure and a memory access issue, potentially leading to accidental or intentional disclosure of data processed by the graphics layer.

Affected Systems

Mozilla Firefox versions earlier than 154, as well as the ESR releases 115.39, 140.14, and 153.1, are vulnerable. Likewise, Mozilla Thunderbird versions before 154, and the ESR releases 140.14 and 153.1, can be affected. Any installation of these older releases remains susceptible until a newer version is installed.

Risk and Exploitability

The CVSS score of 6.5 indicates a medium severity, while the EPSS score of less than 1% signals a low probability of exploitation as of the latest data. The vulnerability is not listed in CISA's KEV catalog, meaning no publicly documented exploits are known. The advisory does not specify a particular attack vector, and additional details on how an attacker might trigger the disclosure are not provided in the captured description.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`115.39`	unaffected	≤ 115.*
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[115.39,115.*]`	unaffected	generic	—
`[140.14,140.*]`	unaffected	generic	—
`[153.1,153.*]`	unaffected	generic	—
`[154,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Mozilla Firefox to version 154 or any supported ESR release (115.39, 140.14, or 153.1).
Upgrade Mozilla Thunderbird to version 154 or any supported ESR release (140.14 or 153.1).
If an upgrade is not immediately possible, disable or limit the graphics component via policy or configuration settings until a patch is available.

Generated by OpenCVE AI on August 21, 2026 at 22:24 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4750-1	firefox-esr security update
Debian DLA	DLA-4754-1	thunderbird security update
Debian DSA	DSA-6451-1	firefox-esr security update
Debian DSA	DSA-6461-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.314% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2060106
https://nvd.nist.gov/vuln/detail/CVE-2026-74948
https://www.cve.org/CVERecord?id=CVE-2026-74948
https://www.mozilla.org/security/advisories/mfsa2026-74/
https://www.mozilla.org/security/advisories/mfsa2026-75/
https://www.mozilla.org/security/advisories/mfsa2026-76/
https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74948
https://www.mozilla.org/security/advisories/mfsa2026-77/
https://www.mozilla.org/security/advisories/mfsa2026-78/
https://www.mozilla.org/security/advisories/mfsa2026-79/
https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74948
https://www.mozilla.org/security/advisories/mfsa2026-80/

History

Aug 24, 2026 4:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird

Aug 21, 2026 8:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-200
Metrics	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}`

Aug 21, 2026 6:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-200

Aug 19, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-497
References		https://nvd.nist.gov/vuln/detail/CVE-2026-74948 https://www.cve.org/CVERecord?id=CVE-2026-74948 https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74948 https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74948
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Aug 18, 2026 7:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.	Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
References		https://www.mozilla.org/security/advisories/mfsa2026-78/ https://www.mozilla.org/security/advisories/mfsa2026-79/ https://www.mozilla.org/security/advisories/mfsa2026-80/

Aug 18, 2026 1:45 PM First appearance in the feed. Weaknesses updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Weaknesses		CWE-200
Vendors & Products		Mozilla Mozilla firefox

Aug 18, 2026 12:45 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.
Title		Information disclosure in the Graphics component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2060106 https://www.mozilla.org/security/advisories/mfsa2026-74/ https://www.mozilla.org/security/advisories/mfsa2026-75/ https://www.mozilla.org/security/advisories/mfsa2026-76/ https://www.mozilla.org/security/advisories/mfsa2026-77/