CVE-2026-74940: Critical Use-After-Free in Firefox Graphics Text

CVE-2026-74940 is a critical (CVSS 9.8) use-after-free in the Graphics Text component of Firefox and Thunderbird. Mozilla fixed it in Firefox 154, ESR 115.39, ESR 140.14, ESR 153.1, and the matching Thunderbird releases. Update your browsers and mail clients to those versions or later.

What's affected

Mozilla lists the fix in Firefox 154, ESR 115.39, ESR 140.14, ESR 153.1, and Thunderbird 154, Thunderbird 140.14 and Thunderbird 153.1. Anything older than the release in your channel is affected.

Mozilla rates the issue's impact as high. The bug report is Bug 2054842, which Mozilla may keep restricted for a while after the fix. The affected component is Graphics: Text. The record lists the old ESR 115.39 line for Firefox among the fixes.

How to check if you're exposed

Open the menu, choose Help, then About Firefox (or About Thunderbird). The dialog shows the version and starts an update check.

From a terminal on Linux or macOS:

firefox --version
thunderbird --version

Managed fleets should check version reports from their endpoint tool, and make sure ESR users are on the fixed ESR build, not only the rapid release.

What to do now

1. Update Firefox to 154, or on the ESR channels to the fixed ESR build named above.
2. Update Thunderbird to 154, 140.14 or 153.1, depending on your channel.
3. Restart the browser and mail client so the new version loads.
4. For managed devices, push the update through your deployment tool and confirm the version afterwards.
5. Where updates lag, reduce risk by limiting browsing on untrusted sites and previewing mail as plain text.

Why it matters

The record maps this to CWE-416, use after free. A program frees a block of memory, then keeps using a pointer to it. If an attacker can arrange for something else to be placed in that memory, the program may read or write data it should not touch.

Browsers run code from the open internet, so memory safety bugs in their engines matter even when they take specific page content to trigger. Mozilla fixes these in regular releases, and the one reliable defense is updating promptly. The KEV flag is false, and the record does not describe exploitation.

Quick check

Sources

• Mozilla advisory MFSA 2026-74 (Firefox 154)
• Mozilla advisory MFSA 2026-75 (Firefox ESR 115.39)
• Mozilla advisory MFSA 2026-76 (Firefox ESR 140.14)

Last reviewed: 19 October 2026.