This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Mozilla Firefox, Firefox ESR and Thunderbird fix 36 vulnerabilities

Mozilla fixes 36 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: Firefox - 151 [1] Firefox ESR - 140.11, 115.36 [2][3] Firefox for iOS - 151, 151.1 [4][5] Thunderbird - 151 [6] Thunderbird ESR - 140.11 [7]

Mozilla Firefox, Firefox ESR, Thunderbird - out-of-bounds write (CVE-2026-8946)
CVSS 7.5 (High)

An unauthenticated remote attacker is able, in the Firefox and Firefox ESR browsers and the Thunderbird mail client, to write outside an allocated memory buffer while audio and video content is processed, due to incorrect bounds checking of the buffer [2][3][4][5][6].

The vulnerability is present in products:

  • Mozilla Thunderbird; <151
  • Mozilla Firefox ESR; >=115, <115.36; >=140, <140.11;
  • Mozilla Firefox; <151;
  • Mozilla Thunderbird ESR; >=140, <140.11;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

  • CVE-2026-8946 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 19. 5. 2026.

Mozilla Firefox, Firefox ESR, Thunderbird - DoS (CVE-2026-8947)
CVSS 7.3 (High)

An unauthenticated remote attacker is able, in the Firefox and Firefox ESR browsers and the Thunderbird mail client, to access memory that has already been freed, which may cause a data processing error and a subsequent application crash [2][3][4][5][6].

The vulnerability is present in products:

  • Mozilla Thunderbird; <151;
  • Mozilla Firefox ESR; >=115, <115.36; >=140, <140.11;
  • Mozilla Firefox; <151;
  • Mozilla Thunderbird ESR; >=140, <140.11;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 19. 5. 2026.

Mozilla Firefox, Firefox ESR, Thunderbird - RCE (CVE-2026-8975)
CVSS 8.8 (High)

An unauthenticated remote attacker is able, in the Firefox and Firefox ESR browsers and the Thunderbird mail client, to corrupt memory by writing outside the allocated memory area and to execute arbitrary code [2][3][4][5][6].

The vulnerability is present in products:

  • Mozilla Thunderbird; <151;
  • Mozilla Firefox ESR; >=115, <115.36; >=140, <140.11;
  • Mozilla Firefox; <151;
  • Mozilla Thunderbird ESR; >=140, <140.11;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2026-8975 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 19. 5. 2026.

By CESNET, z.s.p.o. Henrieta Paločková on 29. 5. 2026.

CESNET, z.s.p.o. Logo