EXPOSURES › CVE-2026-74943

CVE-2026-74943

CRITICAL

DETAIL

SourceNVD · cve Published2026-08-18 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-74943 ↗

⚡ RCE SHAME 65/100 unpatchedrce

Mozilla fixed a critical use-after-free vulnerability in Firefox and Thunderbird's ImageLib component.

A use-after-free flaw in the Graphics: ImageLib component of Firefox and Thunderbird was patched in versions 154 and 140.14. DIBs should ensure their browsers and email clients are updated to mitigate remote code execution risks from unpatched use-after-free bugs.

Shame score — A critical CVSS 9.8 use-after-free bug was fixed, indicating a significant exposure that could have been exploited for remote code execution if unpatched.

▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED

mozilla · vendor firefox · product thunderbird · product

DESCRIPTION

Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.