9.8

CVE-2026-4720

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox SwEditionesr Version < 140.9.0
Mozilla ≫ Firefox SwEdition- Version < 149.0
Mozilla ≫ Thunderbird SwEditionesr Version < 140.9.0
Mozilla ≫ Thunderbird SwEdition- Version < 149.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.34
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0b0ca135-0b70-47e7-9f44-1890c2a1c46c 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

https://www.mozilla.org/security/advisories/mfsa2026-20/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-22/
Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=2004652%2C2019372%2C2021922%2C2022567%2C2022733
Broken Link
https://www.mozilla.org/security/advisories/mfsa2026-23/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-24/
Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:5930
https://access.redhat.com/errata/RHSA-2026:5931
https://access.redhat.com/errata/RHSA-2026:5932
https://access.redhat.com/errata/RHSA-2026:6188
https://access.redhat.com/errata/RHSA-2026:6342
https://access.redhat.com/errata/RHSA-2026:6917
https://access.redhat.com/errata/RHSA-2026:7837
https://access.redhat.com/errata/RHSA-2026:7838
https://access.redhat.com/errata/RHSA-2026:7839
https://access.redhat.com/errata/RHSA-2026:7840
https://access.redhat.com/errata/RHSA-2026:7841
https://access.redhat.com/errata/RHSA-2026:7842
https://access.redhat.com/errata/RHSA-2026:7843
https://access.redhat.com/errata/RHSA-2026:7845
https://access.redhat.com/errata/RHSA-2026:7858
https://access.redhat.com/errata/RHSA-2026:8284
https://access.redhat.com/errata/RHSA-2026:8285
https://access.redhat.com/errata/RHSA-2026:8286
https://access.redhat.com/errata/RHSA-2026:8287
https://access.redhat.com/errata/RHSA-2026:8288
https://access.redhat.com/errata/RHSA-2026:8289
https://access.redhat.com/errata/RHSA-2026:8290
https://access.redhat.com/errata/RHSA-2026:8315
https://access.redhat.com/errata/RHSA-2026:8427
https://access.redhat.com/errata/RHSA-2026:8850
https://access.redhat.com/security/cve/CVE-2026-4720
https://bugzilla.redhat.com/show_bug.cgi?id=2450751
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4720.json