CVE-2026-5731
Published: 07 April 2026
Summary
CVE-2026-5731 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 25.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-5731 involves multiple memory safety bugs, classified under CWE-119, affecting Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. These bugs include instances showing evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable remotely over the network with low complexity, requiring no privileges or user interaction. Attackers can leverage these memory safety issues to corrupt memory and potentially execute arbitrary code within the affected browser or email client processes.
Mozilla's security advisories (MFSA 2026-25 through 2026-28) and associated Bugzilla entries detail the fixes applied in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird ESR 140.9.1. Security practitioners should prioritize updating to these patched versions to mitigate the risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19610
Vulnerability details
Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have…
more
been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption vulnerability in client applications (Firefox/Thunderbird) enabling remote arbitrary code execution with no privileges or user interaction, directly mapping to Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, prioritization, and correction of flaws like these memory safety bugs through patching to fixed versions such as Firefox ESR 140.9.1.
Implements memory protection mechanisms such as ASLR and non-executable memory to prevent exploitation of memory corruption bugs for arbitrary code execution.
Enables vulnerability scanning to identify systems running affected versions of Firefox and Thunderbird vulnerable to this memory safety CVE.