This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Mozilla Firefox, Firefox ESR and Thunderbird fix 5 vulnerabilities
Mozilla fixes 5 vulnerabilities in various products [1]. Products and their fixed versions: Firefox - 149.0.2 [2] Firefox ESR - 115.34.1 [3], 140.9.1 [4] Thunderbird - 149.0.2 [5], 140.9.1 [6] Among operating systems, the vulnerabilities CVE-2026-5731, CVE-2026-5732 and CVE-2026-5734 have been fixed by, for example, Debian [7] and Slackware [8]. Debian releases and fixed versions: bookworm - 140.9.1esr-1~deb12u1 trixie - 140.9.1esr-1~deb13u1
Allows an unauthenticated remote attacker to execute arbitrary code due to a memory corruption vulnerability [9][10].
The vulnerability is present in products:
- Firefox; <149.0.2
- Firefox ESR; <115.34.1; <140.9.1
- Thunderbird; <149.0.2; <140.9.1
- Thunderbird ESR;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-5731 at cve.org, NVD
- CVE-2026-5735 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 7. 4. 2026.
Allows an unauthenticated remote attacker to execute arbitrary code due to a memory corruption vulnerability [11].
The vulnerability is present in products:
- Firefox; <149.0.2
- Firefox ESR; <140.9.1
- Thunderbird; <149.0.2; <140.9.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-5734 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 7. 4. 2026.
Allows an unauthenticated remote attacker to corrupt memory integrity due to incorrect handling of boundary conditions in the Graphics: WebGPU component [12].
The vulnerability is present in products:
- Firefox; <149.0.2
- Thunderbird; <149.0.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-5733 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 7. 4. 2026.
Allows an unauthenticated remote attacker to corrupt memory integrity due to incorrect handling of boundary conditions leading to an integer overflow in the Graphics: Text component [13].
The vulnerability is present in products:
- Firefox; <149.0.2
- Firefox ESR; <140.9.1
- Thunderbird; <149.0.2; <140.9.1
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-5732 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
The vulnerability was publicly disclosed 7. 4. 2026.
Links
- [1] https://www.mozilla.org/en-US/security/advisories/
- [2] https://www.mozilla.org/en-US/security/advisories/mfsa2026-25/
- [3] https://www.mozilla.org/en-US/security/advisories/mfsa2026-26/
- [4] https://www.mozilla.org/en-US/security/advisories/mfsa2026-27/
- [5] https://www.mozilla.org/en-US/security/advisories/mfsa2026-28/
- [6] https://www.mozilla.org/en-US/security/advisories/mfsa2026-29/
- [7] https://lists.debian.org/debian-security-announce/2026/msg00112.html
- [8] https://mirrors.slackware.com/slackware/slackware64-15.0/ChangeLog.txt#src=feeds&time=1775687188
- [9] https://nvd.nist.gov/vuln/detail/CVE-2026-5731
- [10] https://nvd.nist.gov/vuln/detail/CVE-2026-5735
- [11] https://nvd.nist.gov/vuln/detail/CVE-2026-5734
- [12] https://nvd.nist.gov/vuln/detail/CVE-2026-5733
- [13] https://nvd.nist.gov/vuln/detail/CVE-2026-5732
By CESNET, z.s.p.o. Michaela Jarošová on 9. 4. 2026.