CVE-2026-0891: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 147 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 147 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 140.7 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 147 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 140.7
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-0891?
CVE-2026-0891 has been classified as a high severity vulnerability due to its potential for memory corruption.
How do I fix CVE-2026-0891?
To fix CVE-2026-0891, update your Firefox or Firefox ESR to version 147 or 140.7 respectively.
Which versions are affected by CVE-2026-0891?
CVE-2026-0891 affects Firefox ESR 140.6, Firefox 146, Thunderbird ESR 140.6, and Thunderbird 146.
What products are impacted by CVE-2026-0891?
CVE-2026-0891 impacts Mozilla Firefox and Mozilla Firefox ESR products.
What type of vulnerability is CVE-2026-0891?
CVE-2026-0891 is identified as a memory safety vulnerability.