critical
CVE-2026-74940
firefox: thunderbird: Use-after-free in the Graphics: Text component
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), AlmaLinux (high), Amazon (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).
Description
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | firefox | 140.14.0-1.el10_2 |
| alma 8 | firefox, thunderbird | 140.14.0-1.el8_10.alma.1 |
| alma 9 | firefox, firefox-x11, thunderbird | 140.14.0-1.el9_8.alma.1 |
| amazon linux 2 | thunderbird | 140.14.0-1.amzn2.0.1 |
| amazon linux 2023 | firefox, firefox-debuginfo, firefox-debugsource | 140.14.0-1.amzn2023.0.1 |
| chainguard | firefox | 154.0-r0 |
| debian 11 | firefox-esr, thunderbird | 140.14.0esr-1~deb11u1 and 1 more |
| debian 12 | firefox-esr, thunderbird | 140.14.0esr-1~deb12u1 and 1 more |
| debian 13 | firefox-esr, thunderbird | 140.14.0esr-1~deb13u1 and 1 more |
| debian 14 | firefox-esr, thunderbird | 140.14.0esr-2 and 1 more |
| echo | firefox-esr, thunderbird | 140.14.0esr-1~deb12u1 and 1 more |
| Oracle Linux 8 | firefox, thunderbird | 140.14.0-1.0.1.el8_10 |
Show all 73 entries from 38 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | firefox | 140.14.0-1.el10_2 |
| alma 8 | firefox | 140.14.0-1.el8_10.alma.1 |
| alma 8 | thunderbird | 140.14.0-1.el8_10.alma.1 |
| alma 9 | firefox | 140.14.0-1.el9_8.alma.1 |
| alma 9 | firefox-x11 | 140.14.0-1.el9_8.alma.1 |
| alma 9 | thunderbird | 140.14.0-1.el9_8.alma.1 |
| amazon linux 2 | thunderbird | 140.14.0-1.amzn2.0.1 |
| amazon linux 2023 | firefox | 140.14.0-1.amzn2023.0.1 |
| amazon linux 2023 | firefox-debuginfo | 140.14.0-1.amzn2023.0.1 |
| amazon linux 2023 | firefox-debugsource | 140.14.0-1.amzn2023.0.1 |
| chainguard | firefox | 154.0-r0 |
| debian 11 | firefox-esr | 140.14.0esr-1~deb11u1 |
| debian 11 | thunderbird | 1:140.14.0esr-1~deb11u1 |
| debian 12 | firefox-esr | 140.14.0esr-1~deb12u1 |
| debian 12 | thunderbird | 1:140.14.0esr-1~deb12u1 |
| debian 13 | firefox-esr | 140.14.0esr-1~deb13u1 |
| debian 13 | thunderbird | 1:140.14.0esr-1~deb13u1 |
| debian 14 | firefox-esr | 140.14.0esr-2 |
| debian 14 | thunderbird | 1:140.14.0esr-1 |
| echo | firefox-esr | 140.14.0esr-1~deb12u1 |
| echo | thunderbird | 1:140.14.0esr-1~deb12u1 |
| Oracle Linux 8 | firefox | 140.14.0-1.0.1.el8_10 |
| Oracle Linux 8 | thunderbird | 140.14.0-1.0.1.el8_10 |
| Oracle Linux 9 | firefox | 140.14.0-1.0.1.el9_8 |
| Oracle Linux 9 | firefox-x11 | 140.14.0-1.0.1.el9_8 |
| Oracle Linux 9 | thunderbird | 140.14.0-1.0.1.el9_8 |
| rapidfort alma 10 | firefox | 0:140.14.0-1.el10_0, 140.14.0-1.el10_2 |
| rapidfort alma 10 | thunderbird | no fix listed |
| rapidfort alma 9 | firefox | 0:140.14.0-1.el9_2, 140.14.0-1.el9_8.alma.1 |
| rapidfort alma 9 | firefox-x11 | 0:140.14.0-1.el9_2, 140.14.0-1.el9_8.alma.1 |
| rapidfort alma 9 | thunderbird | 0:140.14.0-1.el9_2, 140.14.0-1.el9_8.alma.1 |
| rapidfort alpine 3.20 | firefox | no fix listed |
| rapidfort alpine 3.20 | thunderbird | 144.0-r0, 145.0-r1, 151.0.1-r1 |
| rapidfort alpine 3.21 | firefox | no fix listed |
| rapidfort alpine 3.21 | thunderbird | 144.0-r0, 145.0-r1, 151.0.1-r1 |
| rapidfort alpine 3.22 | firefox | no fix listed |
| rapidfort alpine 3.22 | thunderbird | 144.0-r0, 145.0-r1, 151.0.1-r1 |
| rapidfort alpine 3.23 | firefox | no fix listed |
| rapidfort alpine 3.23 | thunderbird | 145.0-r1, 151.0.1-r1 |
| rapidfort alpine 3.24 | firefox | no fix listed |
| rapidfort alpine 3.24 | thunderbird | 151.0.1-r1 |
| rapidfort amazon linux 2023 | firefox | 140.14.0-1.amzn2023.0.1 |
| rapidfort debian 12 | firefox-esr | 0:140.14.0esr-1~deb11u1, 0:140.14.0esr-1~deb12u1, 0:140.14.0esr-1~deb13u1, 0:140.14.0esr-2 |
| rapidfort debian 12 | thunderbird | 0:140.14.0esr-1~deb12u1, 0:140.14.0esr-1~deb13u1, 1:140.14.0esr-1, 1:140.14.0esr-1~deb11u1 |
| rapidfort debian 13 | firefox-esr | 0:140.14.0esr-1~deb11u1, 0:140.14.0esr-1~deb12u1, 0:140.14.0esr-1~deb13u1, 0:140.14.0esr-2 |
| rapidfort debian 13 | thunderbird | 0:140.14.0esr-1~deb12u1, 0:140.14.0esr-1~deb13u1, 1:140.14.0esr-1, 1:140.14.0esr-1~deb11u1 |
| rapidfort fedora 43 | firefox | 157.0.1-1.fc43 |
| rapidfort fedora 43 | firefox-langpacks | 157.0.1-1.fc43 |
| rapidfort fedora 43 | thunderbird | 145.0-1.fc43 |
| rapidfort fedora 43 | thunderbird-librnp-rnp | 145.0-1.fc43 |
| rapidfort Oracle Linux 10 | firefox | 0:140.14.0-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | thunderbird | no fix listed |
| rapidfort Oracle Linux 9 | firefox | 0:140.14.0-1.0.1.el9_8 |
| rapidfort Oracle Linux 9 | firefox-x11 | 0:140.14.0-1.0.1.el9_8 |
| rapidfort Oracle Linux 9 | thunderbird | 0:140.14.0-1.0.1.el9_8 |
| rapidfort Red Hat 10 | thunderbird | no fix listed |
| rapidfort rocky 10 | thunderbird | no fix listed |
| rapidfort rocky 9 | firefox | 0:140.14.0-1.el9_8 |
| rapidfort rocky 9 | firefox-x11 | 0:140.14.0-1.el9_8 |
| rapidfort rocky 9 | thunderbird | 0:140.14.0-1.el9_8 |
| rapidfort ubuntu 20.04 | thunderbird | no fix listed |
| rapidfort ubuntu 22.04 | thunderbird | no fix listed |
| rapidfort ubuntu 24.04 | thunderbird | no fix listed |
| Red Hat | firefox | no fix listed |
| Red Hat | thunderbird | no fix listed |
| rocky 10 | firefox | 0.0.0 |
| rocky 8 | firefox | 140.14.0-1.el8_10 |
| rocky 8 | thunderbird | 140.14.0-1.el8_10 |
| rocky 9 | firefox | 140.14.0-1.el9_8 |
| rocky 9 | firefox-x11 | 140.14.0-1.el9_8 |
| rocky 9 | thunderbird | 140.14.0-1.el9_8 |
| ubuntu 22.04 | thunderbird | no fix listed |
| wolfi | firefox | 154.0-r0 |
References
- https://access.redhat.com/errata/RHSA-2026:65158
- https://access.redhat.com/security/cve/CVE-2026-74940
- https://bugzilla.mozilla.org/show_bug.cgi?id=2054842
- https://bugzilla.redhat.com/2517820
- https://bugzilla.redhat.com/2517823
- https://bugzilla.redhat.com/2517826
- https://bugzilla.redhat.com/2517831
- https://bugzilla.redhat.com/2517834
All 91 references
- https://bugzilla.redhat.com/2517835
- https://bugzilla.redhat.com/2517836
- https://bugzilla.redhat.com/2517837
- https://bugzilla.redhat.com/2517839
- https://bugzilla.redhat.com/2517841
- https://bugzilla.redhat.com/2517845
- https://bugzilla.redhat.com/2517849
- https://bugzilla.redhat.com/2517851
- https://bugzilla.redhat.com/2517853
- https://bugzilla.redhat.com/2517856
- https://bugzilla.redhat.com/2517859
- https://bugzilla.redhat.com/2517860
- https://bugzilla.redhat.com/2517862
- https://bugzilla.redhat.com/2517863
- https://bugzilla.redhat.com/2517866
- https://bugzilla.redhat.com/2517868
- https://bugzilla.redhat.com/2517872
- https://bugzilla.redhat.com/2517874
- https://bugzilla.redhat.com/show_bug.cgi?id=2517820
- https://bugzilla.redhat.com/show_bug.cgi?id=2517823
- https://bugzilla.redhat.com/show_bug.cgi?id=2517826
- https://bugzilla.redhat.com/show_bug.cgi?id=2517831
- https://bugzilla.redhat.com/show_bug.cgi?id=2517834
- https://bugzilla.redhat.com/show_bug.cgi?id=2517835
- https://bugzilla.redhat.com/show_bug.cgi?id=2517836
- https://bugzilla.redhat.com/show_bug.cgi?id=2517837
- https://bugzilla.redhat.com/show_bug.cgi?id=2517839
- https://bugzilla.redhat.com/show_bug.cgi?id=2517841
- https://bugzilla.redhat.com/show_bug.cgi?id=2517845
- https://bugzilla.redhat.com/show_bug.cgi?id=2517849
- https://bugzilla.redhat.com/show_bug.cgi?id=2517851
- https://bugzilla.redhat.com/show_bug.cgi?id=2517853
- https://bugzilla.redhat.com/show_bug.cgi?id=2517856
- https://bugzilla.redhat.com/show_bug.cgi?id=2517859
- https://bugzilla.redhat.com/show_bug.cgi?id=2517860
- https://bugzilla.redhat.com/show_bug.cgi?id=2517862
- https://bugzilla.redhat.com/show_bug.cgi?id=2517863
- https://bugzilla.redhat.com/show_bug.cgi?id=2517866
- https://bugzilla.redhat.com/show_bug.cgi?id=2517868
- https://bugzilla.redhat.com/show_bug.cgi?id=2517872
- https://bugzilla.redhat.com/show_bug.cgi?id=2517874
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74934
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74935
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74939
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74940
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74942
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74943
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74944
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74945
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74946
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74949
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74957
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74959
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74960
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74962
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74963
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74965
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74971
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74972
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74973
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74974
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74976
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74987
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74990
- https://errata.almalinux.org/9/ALSA-2026-65158.html
- https://errata.rockylinux.org/RLSA-2026:65158
- https://linux.oracle.com/cve/CVE-2026-74940.html
- https://linux.oracle.com/errata/ELSA-2026-65160-0.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-74940
- https://www.cve.org/CVERecord?id=CVE-2026-74940
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-74/#CVE-2026-74940
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-76/#CVE-2026-74940
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-79/#CVE-2026-74940
- https://www.mozilla.org/security/advisories/mfsa2026-74/
- https://www.mozilla.org/security/advisories/mfsa2026-75/
- https://www.mozilla.org/security/advisories/mfsa2026-76/
- https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74940
- https://www.mozilla.org/security/advisories/mfsa2026-77/
- https://www.mozilla.org/security/advisories/mfsa2026-78/
- https://www.mozilla.org/security/advisories/mfsa2026-79/
- https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74940
- https://www.mozilla.org/security/advisories/mfsa2026-80/