CVE-2026-5732: 
NixOS vulnerability analysis and mitigation

CVE-2026-5732 is an integer overflow vulnerability caused by incorrect boundary conditions in the Graphics: Text component of Mozilla Firefox and Firefox ESR. Discovered and reported by security researcher Sajeeb Lohani, it was publicly disclosed on April 7, 2026. Affected versions include Firefox prior to 149.0.2 and Firefox ESR prior to 140.9.1; the same fix was also applied to Thunderbird 149.0.2 and Thunderbird 140.9.1. It carries a CVSS v3.1 base score of 8.8 (High) (Mozilla Advisory mfsa2026-25, Mozilla Advisory mfsa2026-27).

The vulnerability is classified as CWE-190 (Integer Overflow or Wraparound) and stems from incorrect boundary conditions in Firefox's Graphics: Text rendering component. When processing specially crafted text content, the engine fails to properly validate size or length values, allowing an integer to wrap around and produce an unexpectedly small or negative value. This can lead to out-of-bounds memory access or heap corruption, potentially enabling arbitrary code execution. Exploitation requires user interaction — typically visiting a malicious web page or opening a crafted document — but no special privileges or authentication are needed (Mozilla Advisory mfsa2026-25, Mozilla Advisory mfsa2026-27, GitHub Advisory).

Successful exploitation could result in high impact to confidentiality, integrity, and availability of the affected system. An attacker who tricks a user into visiting a malicious web page could potentially execute arbitrary code in the context of the browser process, access sensitive information stored in browser memory, or cause a denial of service via application crash. The vulnerability affects all major platforms running unpatched Firefox or Thunderbird, and could serve as an initial access vector for further compromise of the underlying host (Mozilla Advisory mfsa2026-25, Feedly).

Mozilla has released patched versions addressing this vulnerability: Firefox 149.0.2 and Firefox ESR 140.9.1. Thunderbird users should update to Thunderbird 149.0.2 or Thunderbird ESR 140.9.1. No configuration-based workaround is available; upgrading to a fixed version is the only recommended remediation. Enterprise administrators using Firefox ESR should prioritize deployment of version 140.9.1 or later, and may consider implementing content filtering or browser isolation controls as a temporary measure while patches are being rolled out (Mozilla Advisory mfsa2026-25, Mozilla Advisory mfsa2026-27).

Mozilla rated the vulnerability as High impact and issued coordinated advisories (MFSA 2026-25, MFSA 2026-27, MFSA 2026-28, MFSA 2026-29) on April 7, 2026, covering Firefox, Firefox ESR, and Thunderbird. Major Linux distributions including Debian, SUSE, Red Hat, Rocky Linux, Oracle Linux, AlmaLinux, and Amazon Linux 2 subsequently issued their own security advisories and updated packages. The Center for Internet Security (CIS) also published an advisory noting that multiple vulnerabilities in Mozilla products could allow for arbitrary code execution (CIS Advisory).