CVE-2026-5735
Critical · CVSS 9.8Firefox / Thunderbird — Memory safety bugs / memory corruption leading to arbitrary code execution (out-of-bounds read/write)
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- CWE-787, CWE-125, CWE-787, CWE-787
Description
Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2 and Thunderbird 149.0.2.
Search profile — drives PoC discovery
Symbols mfsa2026-25mfsa2026-28bug_id=2025475bug_id=2025477CVE-2026-5735
Keywords CVE-2026-5735Firefox 149.0.1Thunderbird 149.0.1memory safety bugsmemory corruptionmfsa2026-25mfsa2026-28Firefox memory corruption RCECWE-787CWE-125bugzilla 2025475bugzilla 2025477
Versions: Firefox <= 149.0.1, Thunderbird <= 149.0.1 (fixed in Firefox 149.0.2 and Thunderbird 149.0.2)
References
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025475%2C2025477
- https://www.mozilla.org/security/advisories/mfsa2026-25/
- https://www.mozilla.org/security/advisories/mfsa2026-28/
- https://access.redhat.com/security/cve/CVE-2026-5735
- https://bugzilla.redhat.com/show_bug.cgi?id=2455904
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5735.json
Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T18:30:14.000Z