Is CVE-2026-74964 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74964 being exploited in the wild.

How severe is CVE-2026-74964?

Critical severity, with a CVSS score of 9.8, published 18 August 2026.

Which products and versions are affected?

Mozilla Firefox before 154; Mozilla Firefox ESR before 140.14 and before 153.1; Mozilla Thunderbird before 154; Mozilla Thunderbird ESR before 140.14 and before 153.1.

Is there a fix for CVE-2026-74964?

A patch was published on 2026-08-18: Fixed in Firefox 154, Firefox ESR 140.14 and 153.1, Thunderbird 154, Thunderbird ESR 140.14 and 153.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74964 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-74964?

Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74964: Mozilla Firefox integer overflow in Graphics component

CVE-2026-74964 · Severity: critical · CVSS 9.8 · Published 2026-08-18

Mozilla Firefox and Thunderbird contain an integer overflow vulnerability in their Graphics rendering component. An attacker exploiting this flaw could achieve remote code execution or cause the browser to crash, disrupting users' work and potentially leading to data compromise or system compromise.

Technologies: Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird, Mozilla Thunderbird ESR. Vendors: Mozilla.

Quick answers

Is CVE-2026-74964 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74964 being exploited in the wild.
How severe is CVE-2026-74964?: Critical severity, with a CVSS score of 9.8, published 18 August 2026.
Which products and versions are affected?: Mozilla Firefox before 154; Mozilla Firefox ESR before 140.14 and before 153.1; Mozilla Thunderbird before 154; Mozilla Thunderbird ESR before 140.14 and before 153.1.
Is there a fix for CVE-2026-74964?: A patch was published on 2026-08-18: Fixed in Firefox 154, Firefox ESR 140.14 and 153.1, Thunderbird 154, Thunderbird ESR 140.14 and 153.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74964 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-74964?: Check whether you run Mozilla Firefox, Mozilla Firefox ESR, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the Graphics component of Firefox and Thunderbird. The vulnerability is triggered via network attack vector (malicious web content) and requires no user privileges. An attacker can craft malicious graphics data that causes integer overflow, leading to memory corruption. This can be leveraged for remote code execution or denial of service. The vulnerability has been fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Affected products

Mozilla Firefox before 154
Mozilla Firefox ESR before 140.14 and before 153.1
Mozilla Thunderbird before 154
Mozilla Thunderbird ESR before 140.14 and before 153.1

Timeline

2026-08-18: disclosed: CVE-2026-74964 disclosed in Mozilla Security Advisory MFSA2026-74
2026-08-18: patched: Fixed in Firefox 154, Firefox ESR 140.14 and 153.1, Thunderbird 154, Thunderbird ESR 140.14 and 153.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.