Description
Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Potential Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A race condition in the Layout: Text and Fonts component of Mozilla browsers can result in a use‑after‑free that corrupts memory, potentially leading to application crashes, data leakage, or arbitrary code execution under the user's privileges.

Affected Systems

All Mozilla Firefox releases older than version 154, including ESR releases 115.39, 140.14, and 153.1, and all Thunderbird releases older than 154, including ESR releases 140.14 and 153.1, are affected. Users must upgrade to the patched versions to eliminate the vulnerability.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, but the EPSS score is below 1% and the vulnerability is not listed in CISA KEV, suggesting low current exploitation likelihood. A malicious webpage could trigger the race condition, but no public exploits are known.

Generated by OpenCVE AI on October 28, 2026 at 20:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Firefox to version 154 or later ESR releases (115.39+, 140.14+, 153.1+).
  • Upgrade Thunderbird to version 154 or later ESR releases (140.14+, 153.1+).
  • Enable automatic updates to ensure future security patches are applied promptly.
  • Monitor browser crash logs for signs of memory corruption or anomalous behavior that could indicate an attempted exploitation.

Generated by OpenCVE AI on October 28, 2026 at 20:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4750-1 firefox-esr security update
Debian DLA Debian DLA DLA-4754-1 thunderbird security update
Debian DSA Debian DSA DSA-6451-1 firefox-esr security update
Debian DSA Debian DSA DSA-6461-1 thunderbird security update
History

Wed, 28 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-359
CWE-366

Wed, 28 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Title Use-after-free in the Layout: Text and Fonts component Race condition, use-after-free in the Layout: Text and Fonts component

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla thunderbird
Weaknesses CWE-416
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Vendors & Products Mozilla thunderbird

Wed, 19 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-359
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Wed, 19 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-825
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

threat_severity

Moderate

Tue, 18 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
References

Tue, 18 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-366

Tue, 18 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Vendors & Products Mozilla
Mozilla firefox

Tue, 18 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1.
Title Use-after-free in the Layout: Text and Fonts component
References

Subscriptions

Mozilla Firefox Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-10-28T16:35:49.595Z

Reserved: 2026-08-17T11:58:42.345Z

Link: CVE-2026-74969

cve-icon Vulnrichment

Updated: 2026-08-19T13:01:14.854Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T13:17:34.317

Modified: 2026-10-28T17:18:38.500

Link: CVE-2026-74969

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-08-18T12:23:33Z

Links: CVE-2026-74969 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T20:30:07Z

Weaknesses