Uninitialized memory in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.

The version of mozilla-firefox installed on the remote host is prior to 140.9.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-083-01 advisory.

    New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-firefox security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uninitialized memory in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149,     Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4715)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Thunderbird installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory.

  - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects     Firefox < 149 and Thunderbird < 149. (CVE-2026-4725)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706, CVE-2026-4707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-24 advisory.

  - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 149, Firefox ESR <     140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4717)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4688)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-23 advisory.

  - Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability affects     Firefox < 149 and Thunderbird < 149. (CVE-2026-4725)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706, CVE-2026-4707)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-24 advisory.

  - Privilege escalation in the Netmonitor component. This vulnerability affects Firefox < 149, Firefox ESR <     140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4717)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9. (CVE-2026-4688)

  - Spoofing issue in Thunderbird. This vulnerability affects Thunderbird < 149 and Thunderbird < 140.9.
    (CVE-2026-3889)

  - A malicious mail server could send malformed strings with negative lengths, causing the parser to read     memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker     could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
    (CVE-2026-4371)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.
    (CVE-2026-4684)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-22 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 140.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-22 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 149.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-20 advisory.

  - libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing. (CVE-2025-59375)

  - Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4684)

  - Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox <     149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4685, CVE-2026-4686, CVE-2026-4706,     CVE-2026-4707)

  - Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects     Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9. (CVE-2026-4687)

  - Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects     Firefox < 149 and Firefox ESR < 140.9. (CVE-2026-4688)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
303569	Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2026-083-01)	Nessus	Slackware Local Security Checks	critical
303519	Linux Distros Unpatched Vulnerability : CVE-2026-4715	Nessus	Misc.	critical
303506	Mozilla Thunderbird < 149.0	Nessus	Windows	critical
303505	Mozilla Thunderbird < 140.9	Nessus	MacOS X Local Security Checks	critical
303504	Mozilla Thunderbird < 149.0	Nessus	MacOS X Local Security Checks	critical
303503	Mozilla Thunderbird < 140.9	Nessus	Windows	critical
303474	Mozilla Firefox < 149.0	Nessus	Windows	critical
303473	Mozilla Firefox ESR < 140.9	Nessus	MacOS X Local Security Checks	critical
303472	Mozilla Firefox ESR < 140.9	Nessus	Windows	critical
303471	Mozilla Firefox < 149.0	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2026-4715

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical