high 8.8

CVE-2026-74969 json

Race condition, use-after-free in the Layout: Text and Fonts component

published 2026-08-18 2 mo ago modified 2026-10-28 11 d ago also EUVD-2026-60665

cvss: 8.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits: 0; none known

Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Patch / fix

fixed in 2 distros 6

mozilla firefox 115.39.0, 140.14.0, 153.1.0
mozilla thunderbird 140.14.0, 153.1.0

debian red hat suse opensuse almalinux rocky linux

firefox-esr Debian 12 140.14.0esr-1~deb12u1
firefox-esr Debian 13 140.14.0esr-1~deb13u1
firefox-esr Debian 14 140.14.0esr-2
thunderbird Debian 12 1:140.14.0esr-1~deb12u1
thunderbird Debian 13 1:140.14.0esr-1~deb13u1
thunderbird Debian 14 1:140.14.0esr-1

debian advisories DEBIAN-CVE-2026-74969

firefox RHEL 10.2 140.14.0-1.el10_2
firefox RHEL 9 140.14.0-1.el9_8
firefox-x11 RHEL 9 140.14.0-1.el9_8
firefox RHEL 8 140.14.0-1.el8_10
firefox RHEL 9.2 E4S 140.14.0-1.el9_2
firefox-x11 RHEL 9.2 E4S 140.14.0-1.el9_2
firefox RHEL 7 ELS 140.14.0-1.el7_9
firefox RHEL 8.6 EUS_LONG_LIFE, RHEL 8.6 AUS 140.14.0-1.el8_6

red hat advisories RHSA-2026:65888 RHSA-2026:65442 RHSA-2026:65110 RHSA-2026:65103 RHSA-2026:65105 RHSA-2026:65111

MozillaThunderbird SLE Workstation Extension 15 SP7, SLE Module for Package Hub 15 SP7 153.2.0-150400.13.3.1
mozilla-nss SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 3.125-150400.3.74.1
mozilla-nspr SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 4.39-150400.12.3.1
MozillaFirefox SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 153.2.0-150400.157.5.1
MozillaFirefox-branding-SLE SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 153-150400.14.3.1
mozilla-nss SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.125-160000.1.1
mozilla-nspr SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.39-160000.1.1
rust-cbindgen SLES for SAP applications 16.0, SLES 16.0 0.29.4+git0-160000.1.1

suse advisories SUSE-SU-2026:4268-1 SUSE-SU-2026:4156-1 SUSE-SU-2026:4140-1 SUSE-SU-2026:23411-1 SUSE-SU-2026:23590-1 SUSE-SU-2026:3897-1

rust-cbindgen openSUSE Leap 16.0 0.29.4+git0-160000.1.1
mozilla-nss openSUSE Leap 16.0 3.125-160000.1.1
mozilla-nspr openSUSE Leap 16.0 4.39-160000.1.1
MozillaFirefox openSUSE Leap 16.0 153.1.0-160000.1.2
MozillaFirefox openSUSE Tumbleweed 154.0-1.1
MozillaThunderbird openSUSE Tumbleweed 140.14.0-1.1
MozillaFirefox openSUSE Leap 16.0 140.14.0-160000.1.1
firefox-esr openSUSE Tumbleweed 153.1.0-1.1

opensuse advisories openSUSE-SU-2026:21713-1 openSUSE-SU-2026:11580-1 openSUSE-SU-2026:11558-1 openSUSE-SU-2026:21594-1 openSUSE-SU-2026:11546-1

firefox AlmaLinux 9 140.14.0-1.el9_8.alma.1
firefox-x11 AlmaLinux 9 140.14.0-1.el9_8.alma.1
firefox AlmaLinux 8 140.14.0-1.el8_10.alma.1
firefox AlmaLinux 10 140.14.0-1.el10_2

almalinux advisories ALSA-2026:58897 ALSA-2026:58898 ALSA-2026:58899

firefox Rocky Linux 10 140.14.0-1.el10_2
firefox Rocky Linux 9 140.14.0-1.el9_8
firefox Rocky Linux 8 140.14.0-1.el8_10

rocky linux advisories RLSA-2026:58899 RLSA-2026:58897 RLSA-2026:58898

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-74969 updated 2026-11-06 cvss 6.1

firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component

Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 thunderbird
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 thunderbird
affected: no fix available
Red Hat Enterprise Linux 9 thunderbird Red Hat Enterprise Linux 10 thunderbird, rhel10/firefox-flatpak, rhel10/thunderbird-flatpak
under investigation
Red Hat Enterprise Linux AppStream (v. 8) firefox 140.14.0-1.el8_10
fixed: vendor fix RHSA-2026:58898
Red Hat Enterprise Linux AppStream (v. 9) firefox 140.14.0-1.el9_8, firefox-x11 140.14.0-1.el9_8
fixed: vendor fix RHSA-2026:58897
Red Hat Enterprise Linux AppStream (v. 10) firefox 140.14.0-1.el10_2
fixed: vendor fix RHSA-2026:58899
Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.14.0-1.el8_4
fixed: vendor fix RHSA-2026:65111
Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.14.0-1.el8_6
fixed: vendor fix RHSA-2026:65110

show 9 more

Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.14.0-1.el8_8
fixed: vendor fix RHSA-2026:64814
Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.14.0-1.el9_2, firefox-x11 140.14.0-1.el9_2
fixed: vendor fix RHSA-2026:65888
Red Hat Enterprise Linux AppStream E4S (v.9.4) firefox 140.14.0-1.el9_4, firefox-x11 140.14.0-1.el9_4
fixed: vendor fix RHSA-2026:65105
Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox 140.14.0-1.el10_0
fixed: vendor fix RHSA-2026:64813
Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox 140.14.0-1.el9_6, firefox-x11 140.14.0-1.el9_6
fixed: vendor fix RHSA-2026:65103
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.14.0-1.el8_4
fixed: vendor fix RHSA-2026:65111
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) firefox 140.14.0-1.el8_6
fixed: vendor fix RHSA-2026:65110
Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.14.0-1.el8_8
fixed: vendor fix RHSA-2026:64814
Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.14.0-1.el7_9
fixed: vendor fix RHSA-2026:65442

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 mo ago (2026-08-19)

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Mozilla Firefox
Mozilla Thunderbird

Classification

Weakness

CWE-416 Use After Free

References

mozilla.org /security/advisories/mfsa2026-74/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-75/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-76/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-77/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-78/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-79/
vendor-advisory
mozilla.org /security/advisories/mfsa2026-80/
vendor-advisory
bugzilla.mozilla.org /show_bug.cgi?id=2056065
permissions-required

Sources

CVE List CVE-2026-74969
NVD CVE-2026-74969

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary