CVE-2026-4729
Critical · CVSS 9.8Mozilla Firefox / Thunderbird — Memory safety bugs / Buffer overflow / Dangling pointer (CWE-120, CWE-825) leading to potential arbitrary code execution
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-120, CWE-825
Description
Memory safety bugs present in Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
Search profile — drives PoC discovery
Symbols bug_id=1944033bug_id=1997282bug_id=2009213bug_id=2011412bug_id=2021925bug_id=2022034mfsa2026-20mfsa2026-23CVE-2026-4729
Keywords CVE-2026-4729Firefox 148 memory corruptionThunderbird 148 memory safetymfsa2026-20mfsa2026-23Firefox memory safety bugs PoCCWE-120 CWE-825 FirefoxFirefox 149 patch memory corruptionMozilla memory corruption RCE 2026
Versions: Firefox <= 148, Thunderbird <= 148 (fixed in Firefox 149, Thunderbird 149)
Ranked PoCs (2) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 2
- ★ 2
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1944033%2C1997282%2C2009213%2C2011412%2C2021925%2C2022034
- https://www.mozilla.org/security/advisories/mfsa2026-20/
- https://www.mozilla.org/security/advisories/mfsa2026-23/
- https://access.redhat.com/security/cve/CVE-2026-4729
- https://bugzilla.redhat.com/show_bug.cgi?id=2450745
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4729.json
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T18:30:14.000Z