REDHAT-BUG-2503440: High severity Mozilla Firefox ESR 115.37 vulnerability

Published Jul 21, 2026

Updated

Memory safety bugs present in Firefox ESR 115.37 and Firefox ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38 and Firefox ESR 140.13.

Affected Software

2 affected components

Mozilla Firefox ESR 115.37=115.37

Mozilla Firefox ESR 140.12=140.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 115.38
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 140.13

Event History

Jul 21, 2026

Data Sourced

via Red Hat·01:02 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2503440?

The severity of REDHAT-BUG-2503440 is classified as high, with a score of 7.

How do I fix REDHAT-BUG-2503440?

To fix REDHAT-BUG-2503440, upgrade to Firefox ESR 115.38 or Firefox ESR 140.13.

What vulnerabilities are associated with REDHAT-BUG-2503440?

REDHAT-BUG-2503440 is associated with memory safety bugs that may lead to memory corruption and arbitrary code execution.

Which versions of Firefox are affected by REDHAT-BUG-2503440?

Affected versions include Mozilla Firefox ESR 115.37 and Mozilla Firefox ESR 140.12.

When was REDHAT-BUG-2503440 published?

REDHAT-BUG-2503440 was published on July 21, 2026.