Junglewise Threat Intelligence

CVE-2026-5731: Mozilla Firefox and Thunderbird memory safety bugs

CVE-2026-5731 · Severity: critical · CVSS 9.8 · Published 2026-04-07

Technologies: Mozilla Thunderbird, Mozilla Firefox ESR, Mozilla Thunderbird ESR, Mozilla Firefox. Vendors: Mozilla.

Executive brief

Mozilla has released security updates to address multiple memory safety vulnerabilities in the Firefox web browser and Thunderbird email client. These flaws could allow an attacker to corrupt the application's memory, potentially leading to a complete system takeover or the execution of unauthorized code. While Thunderbird is less susceptible when reading standard emails, the risk remains high in browser-like contexts or if malicious scripts are processed.

Technical details

This advisory covers a collection of memory safety bugs (CWE-119, CWE-787) identified through fuzzing and internal code audits. The root cause involves improper restriction of operations within the bounds of memory buffers, leading to memory corruption. An attacker could potentially exploit these flaws by enticing a user to visit a specially crafted website or interact with malicious content, achieving remote code execution (RCE) without prior authentication. While the CVSS 3.1 score is 9.8 (Critical), some environments like Thunderbird mitigate the risk by disabling scripting in email contexts. Patches are available in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

Affected products

  • Mozilla Firefox 149.0.1
  • Mozilla Firefox ESR 115.34.0, 140.9.0
  • Mozilla Thunderbird 149.0.1
  • Mozilla Thunderbird ESR 140.9.0

Timeline

  • 2026-04-07: advisory: Mozilla Foundation Security Advisory published
  • 2026-04-07: patched: Fixed versions released by Mozilla
  • 2026-04-07: disclosed: Public disclosure via NVD and Mozilla advisories

References

Related threats