CVE-2026-8975
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Memory safety bugs were present in Firefox ESR 115.35, Firefox ESR 140.10, and Firefox 150. Some of these bugs showed evidence of memory corruption and could potentially be exploited to run arbitrary code with enough effort.
Risk Assessment
The risk for the organization is the possibility of remote code execution by an attacker, which could lead to system compromise, data theft, or malware installation.
Recommendation
Immediately update Firefox to version 151 or later, and for ESR versions to 115.36 or 140.11. Thunderbird users should update to version 151 or 140.11.
Original NVD description (English source)
Memory safety bugs present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.