CVE-2026-5732 Mozilla CVE debrief

Who should care

Users of Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR should be aware of this vulnerability and take steps to protect themselves. This includes updating to the latest versions of the software. Additionally, organizations using these products should ensure that their systems are up to date and consider implementing additional security measures to protect against potential attacks.

Technical summary

CVE-2026-5732 is a high-severity vulnerability affecting Mozilla Firefox and Thunderbird. The vulnerability is caused by incorrect boundary conditions and integer overflow in the Graphics: Text component. This vulnerability can be exploited by attackers to potentially execute arbitrary code on affected systems. The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high level of severity. The vulnerability is classified as CWE-190.

Defensive priority

High

Recommended defensive actions

• Update to Firefox 149.0.2 or later
• Update to Firefox ESR 140.9.1 or later
• Update to Thunderbird 149.0.2 or later
• Update to Thunderbird 140.9.1 or later
• Implement additional security measures to protect against potential attacks

Evidence notes

The CVE-2026-5732 vulnerability was publicly disclosed on April 7, 2026, and has since been modified on June 30, 2026. The vulnerability affects multiple products, including Mozilla Firefox and Thunderbird. The CVSS score for this vulnerability is 8.8, indicating a high level of severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.