Executive brief
A vulnerability exists in the graphics processing component of Mozilla Firefox and Thunderbird. This flaw could allow an attacker to cause the application to crash or become unresponsive by processing specially crafted visual content. This primarily impacts the availability of the browser or email client, potentially disrupting user operations.
Technical details
An integer overflow vulnerability (CWE-190) exists in the Graphics component of Mozilla Firefox and Thunderbird due to incorrect boundary conditions (CWE-754). The flaw can be triggered remotely without authentication if the application processes malicious graphical content. According to the CVSS vector, the primary impact is on system availability (Denial of Service), though memory corruption bugs in these components often carry a risk of arbitrary code execution. Patches are available in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, and Thunderbird versions 149 and 140.9.
Affected products
- Mozilla Firefox < 149
- Mozilla Firefox ESR < 115.34, < 140.9
- Mozilla Thunderbird < 149, < 140.9
- Red Hat Enterprise Linux Server (v. 7 ELS) 7
Timeline
- 2026-03-24: disclosed
- 2026-03-24: advisory
- 2026-03-24: patched
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2018430
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-21/
- https://www.mozilla.org/security/advisories/mfsa2026-22/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://www.mozilla.org/security/advisories/mfsa2026-24/
- https://access.redhat.com/errata/RHSA-2026:5930