Loading vulnerability…
Memory Safety Vulnerabilities in Firefox ESR and Thunderbird
CVE-2026-16361 covers memory safety bugs affecting Mozilla Firefox ESR and Thunderbird, including Firefox ESR 115.37 and 140.12 and Thunderbird ESR 140.12. Some bugs exhibit memory corruption that could potentially be exploited to execute arbitrary code. The specific vulnerable functions and corruption mechanisms are not identified. Fixes are available in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could result in memory corruption and potentially arbitrary code execution, compromising data and operations accessible to the affected application process. Arbitrary code execution is a potential consequence rather than a demonstrated outcome; sandbox escape or elevated privileges are not established for this CVE.
If you can’t patch tonight, do this now.
No specific interim workaround is identified. Apply the available security updates.
Patch, then assume compromise.
Upgrade Firefox ESR to 115.38 or later on the 115 ESR branch, or 140.13 or later on the 140 ESR branch. Upgrade Thunderbird to 140.13 or a later security-maintained release. On Debian 13 (trixie), install firefox-esr 140.13.0esr-1~deb13u1 or later and thunderbird 1:140.13.0esr-2~deb13u1 or later, as applicable. Distribution-managed installations should receive the corresponding vendor security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.