CVE-2026-74949

Use-after-free in the Graphics: Canvas2D component

Published Aug 18, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Analysis

Technical impact

The vulnerability is a use‑after‑free flaw in the Graphics: Canvas2D component. An attacker can trigger the flaw to corrupt or read freed memory, potentially enabling execution of arbitrary code within the browser or email client process. The weakness is identified as CWE-416 and may also allow out‑of‑bounds writes (CWE-787).

Affected Systems

Mozilla Firefox users running versions prior to 154, or Firefox ESR versions earlier than 140.14 or 153.1 are vulnerable. Mozilla Thunderbird users running versions prior to 154, or Thunderbird ESR versions earlier than 140.14 or 153.1 are also vulnerable. The problem is present across all supported operating systems for those releases.

Risk and Exploitability

Exploit data has not been publicly documented, but the EPSS score of <1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.8. Based on the description, the most likely vector involves a malicious or compromised website that renders misleading or tainted content in a Canvas2D element, enabling the use‑after‑free (CWE‑416) or out‑of‑bounds write (CWE‑787) to be triggered locally or remotely when the user visits such a page.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mozilla

Firefox

affected

Version	Status	Constraints
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Mozilla

Thunderbird

affected

Version	Status	Constraints
`140.14`	unaffected	≤ 140.*
`153.1`	unaffected	≤ 153.*
`154`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

No data.

Vendor Product Versions

Mozilla

Firefox

Version	Status	Scheme	Platform
`[140.14,140.*]`	unaffected	generic	—
`[153.1,153.*]`	unaffected	generic	—
`[154,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Firefox to version 154 or later, or to Firefox ESR 140.14 or ESR 153.1 if using an extended support channel.
Upgrade Thunderbird to version 154 or later, or to Thunderbird ESR 140.14 or ESR 153.1 if using an extended support channel.
If an upgrade is temporarily infeasible, disable the Canvas2D feature by setting the preferences that control canvas rendering in the browser’s configuration interface for both Firefox and Thunderbird, thereby mitigating the use‑after‑free (CWE‑416) and out‑of‑bounds write (CWE‑787) weaknesses.
Apply network or web‑content filtering to block or sandbox sites that attempt to inject malicious content into Canvas2D elements.

Generated by OpenCVE AI on October 28, 2026 at 17:53 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4750-1	firefox-esr security update
Debian DLA	DLA-4754-1	thunderbird security update
Debian DSA	DSA-6451-1	firefox-esr security update
Debian DSA	DSA-6461-1	thunderbird security update

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.318% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=2060245
https://nvd.nist.gov/vuln/detail/CVE-2026-74949
https://www.cve.org/CVERecord?id=CVE-2026-74949
https://www.mozilla.org/security/advisories/mfsa2026-74/
https://www.mozilla.org/security/advisories/mfsa2026-76/
https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74949
https://www.mozilla.org/security/advisories/mfsa2026-77/
https://www.mozilla.org/security/advisories/mfsa2026-78/
https://www.mozilla.org/security/advisories/mfsa2026-79/
https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74949
https://www.mozilla.org/security/advisories/mfsa2026-80/

History

Oct 28, 2026 4:45 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.	Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Title	Privilege escalation due to use-after-free in the Graphics: Canvas2D component	Use-after-free in the Graphics: Canvas2D component

Sep 1, 2026 10:00 PM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.	Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Title	Use-after-free in the Graphics: Canvas2D component	Privilege escalation due to use-after-free in the Graphics: Canvas2D component

Aug 24, 2026 9:15 AM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.	Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Title	Privilege escalation due to use-after-free in the Graphics: Canvas2D component	Use-after-free in the Graphics: Canvas2D component

Aug 19, 2026 4:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla thunderbird
CPEs		cpe:2.3:a:mozilla:firefox:::::::: cpe:2.3:a:mozilla:thunderbird::::::::
Vendors & Products		Mozilla thunderbird

Aug 19, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-74949 https://www.cve.org/CVERecord?id=CVE-2026-74949 https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74949 https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74949
Metrics	threat_severity `None`	threat_severity `Important`

Aug 18, 2026 7:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description	Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.	Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
References		https://www.mozilla.org/security/advisories/mfsa2026-78/ https://www.mozilla.org/security/advisories/mfsa2026-79/ https://www.mozilla.org/security/advisories/mfsa2026-80/

Aug 18, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 18, 2026 2:30 PM First appearance in the feed. Weaknesses updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mozilla Mozilla firefox
Weaknesses		CWE-416
Vendors & Products		Mozilla Mozilla firefox

Aug 18, 2026 12:45 PM Description updated. Title updated. Added references View changes

Type	Values Removed	Values Added
Description		Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1.
Title		Privilege escalation due to use-after-free in the Graphics: Canvas2D component
References		https://bugzilla.mozilla.org/show_bug.cgi?id=2060245 https://www.mozilla.org/security/advisories/mfsa2026-74/ https://www.mozilla.org/security/advisories/mfsa2026-76/ https://www.mozilla.org/security/advisories/mfsa2026-77/