CVE-2026-74990

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. These bugs involve memory corruption or other security‑relevant defects. With sufficient effort, an attacker could exploit these defects to cause the application to execute arbitrary code or elevate privileges on the host (CWE‑119, CWE‑787). The vulnerabilities were fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mozilla Firefox product line is impacted. Specific vulnerable builds include Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0, and Firefox 153. The fixes were delivered in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. Any earlier versions of Firefox not yet patched may remain vulnerable. Mozilla Thunderbird may also be affected, but specific vulnerable builds are not listed in the description; the fixes start at Thunderbird 140.14 and Thunderbird 153.1, so any older Thunderbird versions may remain vulnerable.

The CVSS score of 9.8 indicates a severe security flaw, while the EPSS score of less than 1% reflects a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through processing of external input such as email attachments or headers handled by Thunderbird, or similarly untrusted web content in Firefox. Exploitation would require an attacker to supply crafted data that triggers the memory corruption, prompting a custom zero‑day effort and likely local code execution or privilege escalation on the victim system.