Security readout for executives and security teams
Plain-English summary
A memory-safety flaw in Mozilla’s image-processing code could let untrusted content destabilize Firefox or Thunderbird and potentially compromise confidentiality, integrity, and availability. Mozilla reports fixes across current and ESR release branches. Organizations should rapidly update managed endpoints, prioritizing systems handling untrusted web pages, images, links, or email content.
Executive priority
Treat this as an urgent enterprise patching event because the documented impact is critical and widely deployed client applications are involved. Accelerate updates and verify coverage. Evidence does not currently justify declaring an active-exploitation emergency, but absence from KEV does not prove exploitation is absent.
Technical view
CVE-2026-74943 is a CWE-416 use-after-free in Graphics: ImageLib. Its CVSS 3.1 score is 9.8, with network reachability, low complexity, no required privileges or user interaction, and high potential impact. The supplied sources do not disclose the trigger, root cause, exploit reliability, or whether code execution has been demonstrated.
Likely exposure
Exposure includes Firefox and Thunderbird installations that have not reached their branch’s fixed release: Firefox 154, ESR 115.39, ESR 140.14, or ESR 153.1; and Thunderbird 154, 140.14, or 153.1. Exact vulnerable version boundaries and platform-specific applicability are not established in the supplied bundle.
Exploitation context
The CVSS vector describes network exploitation without privileges or user interaction, but the supplied evidence does not explain the delivery path. This CVE is not marked as CISA KEV, and no cited source in the bundle establishes active exploitation, public exploit availability, or observed attacks.
Researcher notes
Public details are limited to the ImageLib component, use-after-free classification, CVSS vector, and fixed releases. The supplied bundle contains an “affected” list populated with versions that the description identifies as fixed; treat the description and Mozilla advisories as authoritative until version-range metadata is clarified. Avoid inferring the malformed-image format or exploitation primitive.
Mitigation direction
- Update Firefox to 154 or the applicable fixed ESR release.
- Update Thunderbird to 154, 140.14, or 153.1, as applicable.
- Prioritize internet-facing and high-value endpoints processing untrusted content.
- Check Mozilla advisories for platform, channel, and deployment-specific instructions.
- Use centralized management to prevent outdated installations from remaining active.
Validation and detection
- Inventory installed Firefox and Thunderbird versions across all endpoints.
- Confirm each installation meets its applicable fixed branch version.
- Verify updates succeeded and applications restarted where required.
- Review management reports for update failures, unmanaged devices, and unsupported branches.
- Monitor Mozilla guidance for revised affected ranges or exploitation information.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-74943 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.mozilla.org/show_bug.cgi?id=2057308CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-74/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-75/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-76/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-77/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-78/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-79/CVE reference, mozilla
- https://www.mozilla.org/security/advisories/mfsa2026-80/CVE reference, mozilla
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.