Memory Safety Vulnerability in Firefox ESR by Mozilla
CVE-2026-16361

9.8CRITICAL

Key Information:

Vendor

Mozilla
Status
Firefox
Thunderbird
Vendor
CVE Published:
21 July 2026

What is CVE-2026-16361?

Memory safety bugs have been identified in Firefox ESR versions 115.37 and 140.12, which are characterized by evidence of memory corruption. These vulnerabilities present a risk as they could potentially be exploited to execute arbitrary code, given sufficient effort by an attacker. Mozilla has addressed these concerns in the recent updates, specifically with the releases of Firefox ESR 115.38 and 140.13, which aim to mitigate the risks associated with these memory safety issues.

Affected Version(s)

Thunderbird 140.13

Firefox 115.38

Firefox 140.13

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029734%2...
https://www.mozilla.org/security/advisories/mfsa2026-69/
https://www.mozilla.org/security/advisories/mfsa2026-70/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Mozilla Fuzzing Team
.