---
id: CVE-2026-0891
title: >-
  Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6,
  Firefox 146 and Thunderbird 146
summary: >-
  Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6,
  Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory
  corruption and we presume that with enough effort some of these could have
  been exploit…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-119
vendor: mozilla
product: firefox
affected:
  - firefox < 140.7.0
  - firefox < 147.0
  - thunderbird < 140.7.0
  - thunderbird < 147.0
patched:
  - firefox 147.0
  - thunderbird 147.0
published: '2026-01-13'
updated: '2026-06-30'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0891'
references:
  - url: >-
      https://bugzilla.mozilla.org/buglist.cgi?bug_id=1964722%2C2000981%2C2003100%2C2003278
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-01/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-03/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-04/'
    label: security@mozilla.org
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-05/'
    label: security@mozilla.org
  - url: 'https://access.redhat.com/errata/RHSA-2026:0667'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:0694'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:0924'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1320'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1413'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1414'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1415'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1461'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1462'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1471'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:1487'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2041'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2043'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2044'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2047'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2069'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2070'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2073'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2074'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2220'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2231'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2271'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/errata/RHSA-2026:2286'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://access.redhat.com/security/cve/CVE-2026-0891'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2428963'
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0891.json
    label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-0891'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0891'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2026-0891'
  - url: 'https://www.mozilla.org/security/advisories/mfsa2026-05/#CVE-2026-0891'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.00475
epssPercentile: 0.40883
ingestedAt: '2026-06-30T13:26:50.480Z'
scores:
  nvd: 8.1
  vendor: 7.5
---

## Overview

Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

## Affected

- `firefox < 140.7.0`
- `firefox < 147.0`
- `thunderbird < 140.7.0`
- `thunderbird < 147.0`

## Remediation

Upgrade past the affected range:

- `firefox 147.0`
- `thunderbird 147.0`

## Vendor advisories

- **RHSA-2026:2231** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2231)
- **RHSA-2026:2271** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2271)
- **RHSA-2026:2286** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream (v. 10) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2286)
- **RHSA-2026:0667** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-01-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:0667)
- **RHSA-2026:2220** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-02-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:2220)
- **RHSA-2026:2074** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2074)
- **RHSA-2026:1471** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v. 8.2) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1471)
- **RHSA-2026:2073** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2073)
- **RHSA-2026:1461** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1461)
- **RHSA-2026:2070** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-02-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:2070)
- **RHSA-2026:1487** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1487)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0891.json)