Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

The version of mozilla-firefox installed on the remote host is prior to 140.9.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-083-01 advisory.

    New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-firefox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox     < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4699)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Thunderbird installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory.

  - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects     Firefox < 149 and Thunderbird < 149. (CVE-2026-4725)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706, CVE-2026-4707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-24 advisory.

  - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 149, Firefox ESR <     140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4717)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4688)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory.

  - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects     Firefox < 149 and Thunderbird < 149. (CVE-2026-4725)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706, CVE-2026-4707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-24 advisory.

  - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 149, Firefox ESR <     140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4717)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4688)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-22 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-22 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.34. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-21 advisory.

  - Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148     and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2026-4721)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This     vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4689,     CVE-2026-4690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.34. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-21 advisory.

  - Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148     and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. (CVE-2026-4721)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This     vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4689,     CVE-2026-4690)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303569	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2026-083-01)	Nessus	Slackware Local Security Checks	critical
303522	Linux Distros Unpatched Vulnerability : CVE-2026-4699	Nessus	Misc.	high
303506	Mozilla Thunderbird < 149.0	Nessus	Windows	critical
303505	Mozilla Thunderbird < 140.9	Nessus	MacOS X Local Security Checks	critical
303504	Mozilla Thunderbird < 149.0	Nessus	MacOS X Local Security Checks	critical
303503	Mozilla Thunderbird < 140.9	Nessus	Windows	critical
303474	Mozilla Firefox < 149.0	Nessus	Windows	critical
303473	Mozilla Firefox ESR < 140.9	Nessus	MacOS X Local Security Checks	critical
303472	Mozilla Firefox ESR < 140.9	Nessus	Windows	critical
303471	Mozilla Firefox < 149.0	Nessus	MacOS X Local Security Checks	critical
303470	Mozilla Firefox ESR < 115.34	Nessus	MacOS X Local Security Checks	critical
303469	Mozilla Firefox ESR < 115.34	Nessus	Windows	critical

Detections

Analytics

CVE-2026-4699

high

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical