CVE-2026-74990: 
NixOS vulnerability analysis and mitigation

CVE-2026-74990 is a memory corruption vulnerability affecting Mozilla Firefox and Thunderbird, classified as "Internally found bugs" involving evidence of memory corruption or other security-relevant defects. It affects Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0, Firefox 153, Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153. The vulnerability was discovered internally by Mozilla researchers Christian Holler, Jan de Mooij, and Tom Ritter, and was publicly disclosed on August 18, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-75).

The vulnerability is rooted in improper restriction of operations within the bounds of a memory buffer (CWE-119) and out-of-bounds write (CWE-787), affecting multiple internal components of Firefox and Thunderbird across several ESR branches. Mozilla's internal fuzzing and security review identified multiple bugs — some showing evidence of memory corruption — that were presumed exploitable with sufficient effort. The attack vector is network-based, requires no privileges and no user interaction, making it automatable. No specific technical write-up or public PoC has been released; the underlying bug IDs are tracked in Mozilla Bugzilla (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-75).

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code, read sensitive data, modify system integrity, or crash the affected application. Given the network-accessible attack vector and lack of required user interaction, the potential for widespread exploitation is significant, with full confidentiality, integrity, and availability impact on affected systems. Both desktop browser (Firefox) and email client (Thunderbird) users across multiple ESR branches are at risk (Mozilla Advisory mfsa2026-75, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is reported at 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Mozilla's NVD SSVC assessment classifies exploitation as "none" at this time, though the CVSS score and automatable attack vector indicate high theoretical exploitability (Feedly).

Mozilla has released patches addressing CVE-2026-74990 in the following versions: Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird ESR 140.14, and Thunderbird ESR 153.1. Users and administrators should update all affected Firefox and Thunderbird installations to the patched versions immediately. No configuration-based workarounds have been published; upgrading is the only recommended remediation (Mozilla Advisory mfsa2026-74, Mozilla Advisory mfsa2026-75, Mozilla Advisory mfsa2026-76).

Mozilla issued coordinated security advisories (MFSA 2026-74 through 2026-80) on August 18, 2026, covering this and related vulnerabilities across Firefox and Thunderbird product lines. Red Hat tracked the issue via Bugzilla and published a corresponding CVE entry. Tenable released Nessus detection plugins (IDs 337625 and 337885) shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking (Mozilla Advisory mfsa2026-74, Red Hat CVE).