firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...

CVE-2026-16357

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16361 Memory safety bugs fixed in Thunderbird ESR 140.13

Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbi...

EUVD-2026-46205

Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13...

CVE-2026-16357

CVE-2026-16357 is a Mozilla Firefox/Firefox ESR vulnerability caused by incorrect boundary conditions in the Graphics component. Affected product: Firefox and Firefox ESR. The issue is tracked with a CVSS 3.1 base score of 9.8 (CRITICAL) with network attack vector, no user interaction, and possib...

CVE-2026-16354 Information disclosure in the Graphics: ImageLib component

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16353 Invalid pointer in the DOM: Bindings (WebIDL) component

Invalid pointer in the DOM: Bindings WebIDL component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16352

CVE-2026-16352 is a sandbox-escape vulnerability due to a use-after-free in the Disability Access APIs component of Mozilla Firefox. The issue is fixed in Firefox 153 , and in Firefox ESR 115.38 and 140.13 . Affected product is Mozilla Firefox ESR (earlier than 115.38 per related advisory). The p...

CVE-2026-16349

CVE-2026-16349 : Same-origin policy bypass in the DOM: Navigation component affects Mozilla Firefox and Firefox ESR. Root cause is a bypass vulnerability in the Navigation component that can impact confidentiality, integrity, and availability (CVSS v3.1: 9.8, high) with network attack vector and ...

PT-2026-61862

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description Incorrect boundary conditions exist within the Audio/Vide...

PT-2026-61866

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description An information disclosure issue exists within the Graphic...