CVE-2026-74987: 
NixOS vulnerability analysis and mitigation

CVE-2026-74987 is a memory safety vulnerability affecting Mozilla Firefox and Thunderbird, classified as High severity. It was internally discovered by Nicolas Silva, Tom Ritter, and the Mozilla Fuzzing Team, and publicly disclosed on August 18, 2026. The vulnerability affects Firefox ESR 140.13, Firefox ESR 153.0, Firefox 153, Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153. Some of the internally found bugs showed evidence of memory corruption or other security-relevant defects, and Mozilla presumes that with sufficient effort, some could have been exploited. The CVSS category estimate is High (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-76).

The vulnerability is a collection of internally discovered memory safety bugs (CWE-119/CWE-120 class — memory corruption) present across multiple components of Firefox and Thunderbird. The bugs were identified through internal fuzzing and code review by Mozilla's security team, and some showed evidence of memory corruption or other security-relevant defects. Because these are bundled memory safety issues rather than a single discrete flaw, the precise attack vector varies per underlying bug, but the general class of memory corruption vulnerabilities can enable arbitrary code execution if successfully weaponized. Specific bug IDs are referenced in Mozilla's Bugzilla across two bug lists covering high, moderate, and low severity internally found issues (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-76, Bugzilla Bug List).

Successful exploitation of the most severe bugs in this group could allow an attacker to execute arbitrary code in the context of the browser or email client process, potentially leading to full compromise of the affected user's session and system. Memory corruption vulnerabilities in browsers can be leveraged to escape sandboxes, escalate privileges, or achieve remote code execution via malicious web content or email. The impact spans confidentiality, integrity, and availability, with risk of sensitive data exposure, unauthorized actions, and application crashes (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-76).

As of the disclosure date (August 18, 2026), Mozilla has not reported active in-the-wild exploitation of CVE-2026-74987. No public proof-of-concept exploit code has been identified. The EPSS score is reported as 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. The vulnerability was found internally, reducing the likelihood of immediate weaponization, though the memory corruption nature of the bugs means exploitation is theoretically feasible with sufficient effort (Mozilla Advisory mfsa2026-74, Feedly).

Mozilla has released patched versions addressing CVE-2026-74987: Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird ESR 140.14, and Thunderbird ESR 153.1. Users and administrators should update to these versions immediately. No configuration-based workarounds are available for memory safety vulnerabilities of this class; upgrading is the only effective remediation (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-76).

Mozilla's security advisories for the August 18, 2026 release cycle were picked up by standard vulnerability tracking services including Tenable (Nessus plugins 337625, 337885, 337948) and AusCERT (ESB-2026.9669). Kaspersky's threat intelligence portal also catalogued the vulnerability (KLA91231). No notable independent researcher commentary or significant social media discussion has been identified beyond standard advisory republication.