Is CVE-2026-5731 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5731 being exploited in the wild.

How severe is CVE-2026-5731?

Critical severity, with a CVSS score of 9.8, published 7 April 2026.

Which products and versions are affected?

Mozilla Firefox 149.0.1; Mozilla Firefox ESR 115.34.0, 140.9.0; Mozilla Thunderbird 149.0.1; Mozilla Thunderbird ESR 140.9.0.

Is there a fix for CVE-2026-5731?

A patch was published on 2026-04-07: Fixed versions released by Mozilla Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5731 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5731?

Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5731: Mozilla Firefox and Thunderbird memory safety bugs

CVE-2026-5731 · Severity: critical · CVSS 9.8 · Published 2026-04-07

Mozilla has released security updates to address multiple memory safety vulnerabilities in the Firefox web browser and Thunderbird email client. These flaws could allow an attacker to corrupt the application's memory, potentially leading to a complete system takeover or the execution of unauthorized code. While Thunderbird is less susceptible when reading standard emails, the risk remains high in browser-like contexts or if malicious scripts are processed.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla Thunderbird ESR. Vendors: Mozilla.

Quick answers

Is CVE-2026-5731 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5731 being exploited in the wild.
How severe is CVE-2026-5731?: Critical severity, with a CVSS score of 9.8, published 7 April 2026.
Which products and versions are affected?: Mozilla Firefox 149.0.1; Mozilla Firefox ESR 115.34.0, 140.9.0; Mozilla Thunderbird 149.0.1; Mozilla Thunderbird ESR 140.9.0.
Is there a fix for CVE-2026-5731?: A patch was published on 2026-04-07: Fixed versions released by Mozilla Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5731 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5731?: Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This advisory covers a collection of memory safety bugs (CWE-119, CWE-787) identified through fuzzing and internal code audits. The root cause involves improper restriction of operations within the bounds of memory buffers, leading to memory corruption. An attacker could potentially exploit these flaws by enticing a user to visit a specially crafted website or interact with malicious content, achieving remote code execution (RCE) without prior authentication. While the CVSS 3.1 score is 9.8 (Critical), some environments like Thunderbird mitigate the risk by disabling scripting in email contexts. Patches are available in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

Affected products

Mozilla Firefox 149.0.1
Mozilla Firefox ESR 115.34.0, 140.9.0
Mozilla Thunderbird 149.0.1
Mozilla Thunderbird ESR 140.9.0

Timeline

2026-04-07: advisory: Mozilla Foundation Security Advisory published
2026-04-07: patched: Fixed versions released by Mozilla
2026-04-07: disclosed: Public disclosure via NVD and Mozilla advisories

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.