{"id":"CVE-2026-0891","title":"Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146","summary":"Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploit…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-119"],"vendor":"mozilla","product":"firefox","affected":["firefox < 140.7.0","firefox < 147.0","thunderbird < 140.7.0","thunderbird < 147.0"],"patched":["firefox 147.0","thunderbird 147.0"],"published":"2026-01-13","updated":"2026-06-30","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-0891","references":[{"url":"https://bugzilla.mozilla.org/buglist.cgi?bug_id=1964722%2C2000981%2C2003100%2C2003278","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-01/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-03/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-04/","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-05/","label":"security@mozilla.org"},{"url":"https://access.redhat.com/errata/RHSA-2026:0667","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:0694","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:0924","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1320","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1413","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1414","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1415","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1461","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1462","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1471","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:1487","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2041","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2043","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2044","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2047","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2069","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2070","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2073","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2074","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2220","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2231","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2271","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:2286","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-0891","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2428963","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0891.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-0891"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0891"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2026-0891"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-05/#CVE-2026-0891"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00475,"epssPercentile":0.40883,"ingestedAt":"2026-06-30T13:26:50.480Z","scores":{"nvd":8.1,"vendor":7.5},"slug":"CVE-2026-0891","body":"## Overview\n\nMemory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.\n\n## Affected\n\n- `firefox < 140.7.0`\n- `firefox < 147.0`\n- `thunderbird < 140.7.0`\n- `thunderbird < 147.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `firefox 147.0`\n- `thunderbird 147.0`\n\n## Vendor advisories\n\n- **RHSA-2026:2231** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2231)\n- **RHSA-2026:2271** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2271)\n- **RHSA-2026:2286** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2286)\n- **RHSA-2026:0667** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-01-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:0667)\n- **RHSA-2026:2220** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2220)\n- **RHSA-2026:2074** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2074)\n- **RHSA-2026:1471** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1471)\n- **RHSA-2026:2073** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2073)\n- **RHSA-2026:1461** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1461)\n- **RHSA-2026:2070** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2070)\n- **RHSA-2026:1487** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1487)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0891.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}