CVE-2026-5731

high

Description

Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

References

https://www.mozilla.org/security/advisories/mfsa2026-29/

https://www.mozilla.org/security/advisories/mfsa2026-28/

https://www.mozilla.org/security/advisories/mfsa2026-27/

https://www.mozilla.org/security/advisories/mfsa2026-26/

https://www.mozilla.org/security/advisories/mfsa2026-25/

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5731.json

https://bugzilla.redhat.com/show_bug.cgi?id=2455901

https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021894%2C2022225%2C2022252%2C2022294%2C2023007%2C2023130%2C2023191%2C2023364%2C2023829%2C2024074%2C2024417%2C2024433%2C2024436%2C2024437%2C2024453%2C2024461%2C2024462%2C2024472%2C2024474%2C2024477%2C2025364%2C2025401%2C2025402%2C2025472%2C2026287%2C2026299%2C2026305%2C2026426

https://access.redhat.com/security/cve/CVE-2026-5731

https://access.redhat.com/errata/RHSA-2026:9638

https://access.redhat.com/errata/RHSA-2026:9345

https://access.redhat.com/errata/RHSA-2026:8459

https://access.redhat.com/errata/RHSA-2026:8052

https://access.redhat.com/errata/RHSA-2026:7672

https://access.redhat.com/errata/RHSA-2026:7671

https://access.redhat.com/errata/RHSA-2026:15889

https://access.redhat.com/errata/RHSA-2026:14303

https://access.redhat.com/errata/RHSA-2026:14223

https://access.redhat.com/errata/RHSA-2026:13977

https://access.redhat.com/errata/RHSA-2026:13922

https://access.redhat.com/errata/RHSA-2026:13683

https://access.redhat.com/errata/RHSA-2026:13682

https://access.redhat.com/errata/RHSA-2026:13665

https://access.redhat.com/errata/RHSA-2026:13600

https://access.redhat.com/errata/RHSA-2026:13596

https://access.redhat.com/errata/RHSA-2026:13583

https://access.redhat.com/errata/RHSA-2026:13582

https://access.redhat.com/errata/RHSA-2026:13533

https://access.redhat.com/errata/RHSA-2026:13412

https://access.redhat.com/errata/RHSA-2026:13342

https://access.redhat.com/errata/RHSA-2026:12264

https://access.redhat.com/errata/RHSA-2026:11813

https://access.redhat.com/errata/RHSA-2026:11805

Details

Source: Mitre, NVD

Published: 2026-04-07

Updated: 2026-06-30

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.00055