CVE-2026-5734
Published: 07 April 2026
Summary
CVE-2026-5734 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Mozilla Firefox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 23.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5734 encompasses multiple memory safety bugs, including those mapped to CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Bounds Check), affecting Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1, and Thunderbird 149.0.1. These bugs demonstrated evidence of memory corruption in some cases, leading Mozilla to presume that sufficient effort could enable arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 9.8, reflecting its critical severity.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, no user interaction, and without changing the scope of impact. Successful exploitation could result in high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution within the affected browser or mail client processes.
Mozilla's security advisories (MFSA 2026-25 through MFSA 2026-29) and associated Bugzilla entries detail the fixes, which are available in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird ESR 140.9.1. Security practitioners should prioritize updating affected installations to these patched versions to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19614
Vulnerability details
Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to…
more
run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote memory corruption vulnerability (out-of-bounds write/buffer overflow) in client applications (Firefox/Thunderbird) enabling arbitrary code execution with no user interaction or privileges required.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and correction of software flaws such as these memory safety bugs via vendor patches like Firefox 149.0.2.
Implements memory safeguards to protect against unauthorized code execution resulting from memory corruption exploits presumed possible in this CVE.
Requires validation of information inputs to mitigate root causes like CWE-787 out-of-bounds writes and CWE-120 buffer copy without bounds checks.