PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8949 Mozilla CVE debrief

CVE-2026-8949 is an integer overflow in Mozilla's Widget: Win32 component. Mozilla fixed it in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. NVD rates the issue CVSS 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which points to a remotely reachable availability impact without privileges or user interaction.

Vendor
Mozilla
Product
Firefox
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-20
Advisory published
2026-05-19
Advisory updated
2026-05-20

Who should care

Mozilla Firefox and Thunderbird users and administrators, especially on Windows systems and any environment still running versions earlier than Firefox 151, Firefox ESR 140.11, Thunderbird 151, or Thunderbird 140.11.

Technical summary

NVD classifies the weakness as CWE-190 (integer overflow). The published CPE criteria mark Firefox (regular and ESR) and Thunderbird (regular and ESR) as vulnerable up to, but not including, the fixed versions listed by Mozilla. The reference set includes Mozilla Bugzilla and multiple Mozilla security advisories, indicating vendor-confirmed remediation.

Defensive priority

High

Recommended defensive actions

  • Upgrade Firefox to 151 or later.
  • Upgrade Firefox ESR to 140.11 or later.
  • Upgrade Thunderbird to 151 or later.
  • Upgrade Thunderbird ESR to 140.11 or later.
  • Prioritize Windows endpoints and application fleets that rely on Mozilla desktop clients for rapid patching.
  • Verify deployments against the NVD CPE/version ranges to confirm no affected builds remain in service.

Evidence notes

The debrief is based on the NVD CVE record and Mozilla-linked references supplied in the source corpus. NVD lists the vulnerability as analyzed, assigns CWE-190, and provides vulnerable version boundaries for Firefox and Thunderbird. The fixed versions are explicitly stated in the CVE description. No exploit details or unsupported impact claims are included.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8949 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8949

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8949 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8949

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.