CVE-2026-74973

Analyzed Analyzed - Analysis Complete

Race Condition and Use-After-Free in Firefox

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: Mozilla Corporation

Description

Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-18

EPSS Evaluated

2026-09-06

NVD

CVE-2026-74973

EUVD

EUVD-2026-60668

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	firefox	to 115.39.0 (exc)
mozilla	firefox	From 116.0 (inc) to 140.14.0 (exc)
mozilla	firefox	From 141.0 (inc) to 153.1.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.1.0 (exc)
mozilla	thunderbird	to 140.14.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This is a race condition and use-after-free vulnerability in Firefox's Graphics component. A race condition occurs when two or more threads access shared data simultaneously, leading to unpredictable behavior. Use-after-free happens when a program continues to use memory after it has been freed, potentially causing crashes or arbitrary code execution.

Detection Guidance

This vulnerability is a race condition and use-after-free in Firefox's Graphics component. Detection requires checking Firefox version against patched releases (Firefox 154, ESR 115.39, ESR 140.14, ESR 153.1). Use commands like 'firefox --version' or check about:support in Firefox to verify version.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code, crash the application, or gain unauthorized access to sensitive data. It primarily affects users of vulnerable Firefox versions by compromising browser stability and security.

Compliance Impact

The provided CVE data does not specify how this vulnerability impacts compliance with standards like GDPR or HIPAA. The description only mentions a race condition and use-after-free in the Graphics component, fixed in specific Firefox versions.

Mitigation Strategies

Immediately update Firefox to version 154 or Firefox ESR to 115.39, 140.14, or 153.1. Disable automatic graphics rendering if updates are delayed by setting MOZ_USE_XINPUT2=0 in environment variables.

Hi! I’m here to help you understand CVE-2026-74973. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70