CVE-2026-5734 covers memory safety bugs in Firefox ESR 140.9.0, Firefox 149.0.1, Thunderbird ESR 140.9.0 and Thunderbird 149.0.1. Mozilla fixed them in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2 and Thunderbird 140.9.1. Update, and restart the application. Restart the applications after updating.
What's affected
Mozilla's advisory says memory safety bugs were present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some showed evidence of memory corruption, and Mozilla presumes that with enough effort some could be exploited to run arbitrary code.
Fixed versions: Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2 and Thunderbird 140.9.1. Mozilla lists the issue under mfsa2026-25 for Firefox, mfsa2026-27 for Firefox ESR and mfsa2026-28 for Thunderbird.
For Thunderbird, Mozilla notes that these flaws generally cannot be exploited through email in that product, because scripting is disabled when reading mail. They are potential risks in browser or browser-like contexts.
How to check if you're exposed
- In Firefox, open the menu, then Help, then About Firefox. It shows the version and starts an update check.
- In Thunderbird, use Help, then About Thunderbird.
- Check managed fleets with your software inventory tool, and look for versions below 149.0.2 or, on the ESR channel, below 140.9.1.
- Do not forget Linux distribution packages and kiosk or embedded browsers, which update on their own schedule.
What to do now
- Update Firefox to 149.0.2 or later, or Firefox ESR to 140.9.1 or later.
- Update Thunderbird to 149.0.2 or 140.9.1 or later.
- Restart the applications, since an update does not apply to a running process.
- For managed fleets, push the update through your software distribution tool and check compliance.
- Apply the distribution package updates for Linux machines.
Why it matters
The record lists CWE-120, classic buffer overflow, and CWE-787, out-of-bounds write. Memory safety bugs are found by Mozilla's own fuzzing team and others, and a group of them is often fixed under one identifier. The advisory credits Brian Grinstead, Christian Holler, Tom Schuster and the Mozilla Fuzzing Team.
The record is not in CISA's Known Exploited Vulnerabilities catalog, and Mozilla does not say any were used in attacks. The score is high since a browser parses content from anywhere on the internet. Quick updates are the main defence.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is Thunderbird safe to read mail in?
Mozilla says these flaws generally cannot be exploited through email in Thunderbird because scripting is disabled when reading mail. Update anyway, since browser-like contexts remain.
Sources
Last reviewed: 19 October 2026.
