CVE-2026-74940 Mozilla CVE debrief

Who should care

Users of Firefox, Thunderbird, and their ESR versions should be aware of this vulnerability and take action to patch their installations to prevent potential exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact on their systems and prioritize patching. Affected deployments in managed environments require confirmation and assignment of an owner for follow-up. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified.

Technical summary

The CVE-2026-74940 vulnerability is a use-after-free issue in the Graphics: Text component of Firefox. This vulnerability has been patched in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. The vulnerability has a critical severity with a CVSS score of 9.8. It is recommended to patch vulnerable versions of Firefox and Thunderbird due to critical severity and potential for exploitation. The CVE record and NVD detail provide information on the vulnerability, including its critical severity and affected products. Vendor advisories are available for mitigation.

Defensive priority

High priority to patch vulnerable versions of Firefox and Thunderbird due to critical severity and potential for exploitation.

Recommended defensive actions

• Patch Firefox to version 154 or later
• Patch Thunderbird to version 154 or later
• Update Firefox ESR to version 115.39 or later
• Update Firefox ESR to version 140.14 or later
• Update Firefox ESR to version 153.1 or later
• Update Thunderbird ESR to version 140.14 or later
• Update Thunderbird ESR to version 153.1 or later

Evidence notes

The CVE record and NVD detail provide information on the vulnerability, including its critical severity and affected products. Vendor advisories are available for mitigation. The vulnerability exists in the Graphics: Text component of Firefox, which was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Users should verify their installations and apply patches accordingly. The CVE record was published on 2026-08-18T13:17:30.370Z and has not been modified since then. The NVD entry is currently Analyzed. Additional verification is recommended for deployments in managed environments.

Official resources