PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8949 Mozilla CVE debrief

CVE-2026-8949 is an integer overflow in Mozilla's Widget: Win32 component. Mozilla fixed it in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. NVD rates the issue CVSS 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which points to a remotely reachable availability impact without privileges or user interaction.

Vendor
Mozilla
Product
Firefox
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-20
Advisory published
2026-05-19
Advisory updated
2026-05-20

Who should care

Mozilla Firefox and Thunderbird users and administrators, especially on Windows systems and any environment still running versions earlier than Firefox 151, Firefox ESR 140.11, Thunderbird 151, or Thunderbird 140.11.

Technical summary

NVD classifies the weakness as CWE-190 (integer overflow). The published CPE criteria mark Firefox (regular and ESR) and Thunderbird (regular and ESR) as vulnerable up to, but not including, the fixed versions listed by Mozilla. The reference set includes Mozilla Bugzilla and multiple Mozilla security advisories, indicating vendor-confirmed remediation.

Defensive priority

High

Recommended defensive actions

  • Upgrade Firefox to 151 or later.
  • Upgrade Firefox ESR to 140.11 or later.
  • Upgrade Thunderbird to 151 or later.
  • Upgrade Thunderbird ESR to 140.11 or later.
  • Prioritize Windows endpoints and application fleets that rely on Mozilla desktop clients for rapid patching.
  • Verify deployments against the NVD CPE/version ranges to confirm no affected builds remain in service.

Evidence notes

The debrief is based on the NVD CVE record and Mozilla-linked references supplied in the source corpus. NVD lists the vulnerability as analyzed, assigns CWE-190, and provides vulnerable version boundaries for Firefox and Thunderbird. The fixed versions are explicitly stated in the CVE description. No exploit details or unsupported impact claims are included.

Official resources

Published 2026-05-19T14:16:51.140Z; modified 2026-05-20T14:49:05.930Z. Timing in this debrief uses the CVE published and modified timestamps provided in the source corpus.