CVE-2026-7323
Published: 28 April 2026
Summary
CVE-2026-7323 is a high-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Mozilla Firefox. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 5.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-7323 involves multiple memory safety bugs (CWE-119 and CWE-787) present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. These bugs demonstrated evidence of memory corruption, which Mozilla presumes could be exploited with sufficient effort to achieve arbitrary code execution. The vulnerability carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network-accessible nature and low barriers to exploitation.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and without requiring user interaction or privileges. Successful exploitation could result in low-level impacts to confidentiality, integrity, and availability, though the memory corruption evidence suggests potential for more severe outcomes like code execution if chained or refined.
Mozilla addressed the issue in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird ESR 140.10.1. Security practitioners should prioritize updating affected Thunderbird installations. Additional details are available in Mozilla's advisories (MFSA 2026-35, 36, 38, 39) and related Bugzilla entries (bugs 2028537, 2029911, 2031121, 2033602).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26060
Vulnerability details
Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability…
more
was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Memory corruption vulnerability in Thunderbird email client enabling remote arbitrary code execution without user interaction directly maps to T1203 Exploitation for Client Execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, mitigation, and correction of software flaws like the memory safety bugs in Thunderbird to prevent arbitrary code execution.
Requires regular vulnerability scanning to identify systems running vulnerable Thunderbird versions affected by CVE-2026-7323.
Ensures receipt and dissemination of security advisories like Mozilla's MFSA notices for CVE-2026-7323 to enable prompt flaw remediation.