CVE-2026-6786

Description

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

References

https://www.mozilla.org/security/advisories/mfsa2026-34/

https://www.mozilla.org/security/advisories/mfsa2026-33/

https://www.mozilla.org/security/advisories/mfsa2026-32/

https://www.mozilla.org/security/advisories/mfsa2026-30/

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6786.json

https://bugzilla.redhat.com/show_bug.cgi?id=2460088

https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2019547%2C2020378%2C2022381%2C2022608%2C2022785%2C2023120%2C2023128%2C2023140%2C2023279%2C2023836%2C2023882%2C2023925%2C2023950%2C2023959%2C2023965%2C2024243%2C2024245%2C2024247%2C2024253%2C2024346%2C2024357%2C2024416%2C2024420%2C2024429%2C2024432%2C2024455%2C2024466%2C2024468%2C2024476%2C2024664%2C2024666%2C2024669%2C2024670%2C2024671%2C2024761%2C2024918%2C2025292%2C2025332%2C2025348%2C2025384%2C2025395%2C2025458%2C2025461%2C2025463%2C2025481%2C2025483%2C2025485%2C2025494%2C2025506%2C2025511%2C2025513%2C2025520%2C2026277%2C2026282%2C2026288%2C2026289%2C2026311%2C2026312%2C2026869%2C2027152%2C2027161%2C2027238%2C2027261%2C2027269%2C2027274%2C2027280%2C2027281%2C2027300%2C2027302%2C2027331%2C2027339%2C2027340%2C2027738%2C2027975%2C2028000%2C2028011%2C2028289%2C2028525%2C2028728%2C2028887%2C2028888%2C2028896%2C2029063%2C2029064%2C2029290%2C2029291%2C2029294%2C2029300%2C2029304%2C2029316%2C2029317%2C2029401%2C2029415%2C2029430%2C2029457%2C2029727%2C2029735%2C2029743%2C2029752%2C2029754%2C2029776%2C2029809%2C2030324%2C2030370

https://access.redhat.com/security/cve/CVE-2026-6786

https://access.redhat.com/errata/RHSA-2026:19704

https://access.redhat.com/errata/RHSA-2026:19655

https://access.redhat.com/errata/RHSA-2026:19542

https://access.redhat.com/errata/RHSA-2026:19469

https://access.redhat.com/errata/RHSA-2026:19468

https://access.redhat.com/errata/RHSA-2026:19467

https://access.redhat.com/errata/RHSA-2026:19466

https://access.redhat.com/errata/RHSA-2026:19465

https://access.redhat.com/errata/RHSA-2026:19464

https://access.redhat.com/errata/RHSA-2026:19463

https://access.redhat.com/errata/RHSA-2026:19462

https://access.redhat.com/errata/RHSA-2026:19461

https://access.redhat.com/errata/RHSA-2026:19348

https://access.redhat.com/errata/RHSA-2026:19201

https://access.redhat.com/errata/RHSA-2026:19131

https://access.redhat.com/errata/RHSA-2026:19041

https://access.redhat.com/errata/RHSA-2026:17690

https://access.redhat.com/errata/RHSA-2026:17689

https://access.redhat.com/errata/RHSA-2026:17688

https://access.redhat.com/errata/RHSA-2026:17687

https://access.redhat.com/errata/RHSA-2026:17477

https://access.redhat.com/errata/RHSA-2026:15892

https://access.redhat.com/errata/RHSA-2026:13537

https://access.redhat.com/errata/RHSA-2026:12285

https://access.redhat.com/errata/RHSA-2026:10767

https://access.redhat.com/errata/RHSA-2026:10766

https://access.redhat.com/errata/RHSA-2026:10757

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS