CVE-2026-16360

Analyzed Analyzed - Analysis Complete

Memory Corruption in Firefox ESR and Firefox

Publication date: 2026-07-21

Last updated on: 2026-07-24

Assigner: Mozilla Corporation

Description

Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-24

Generated

2026-08-10

AI Q&A

2026-07-21

EPSS Evaluated

2026-08-09

NVD

CVE-2026-16360

EUVD

EUVD-2026-46251

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 153.0.0 (exc)
mozilla	firefox	to 115.38.0 (exc)
mozilla	firefox	From 128.1.0 (inc) to 140.13.0 (exc)
mozilla	thunderbird	to 140.13.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability involves memory safety bugs in Firefox ESR 115.37, Firefox ESR 140.12, and Firefox 152. These bugs can lead to memory corruption and may allow attackers to execute arbitrary code if exploited successfully.

Detection Guidance

This vulnerability is specific to outdated versions of Firefox ESR and Firefox. Detection involves checking installed Firefox versions. For Linux systems, use commands like 'firefox --version' or 'dpkg -l firefox' (Debian/Ubuntu) or 'rpm -qa firefox' (RHEL/Fedora). For Windows, check 'Programs and Features' or run 'where firefox' in Command Prompt.

Impact Analysis

If exploited, this vulnerability could allow attackers to run malicious code on your system, potentially leading to unauthorized access, data theft, or installation of malware. Users of affected Firefox versions should update immediately.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability involves memory safety issues in Firefox that could potentially allow arbitrary code execution, which may lead to data breaches or unauthorized access. However, without explicit details on data handling or regulatory implications, the exact compliance impact cannot be determined from this CVE alone.

Mitigation Strategies

Update Firefox to version 153 or later, Firefox ESR 115.38 or later, or Firefox ESR 140.13 or later to address the memory safety bugs.

Hi! I’m here to help you understand CVE-2026-16360. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70