Critical Security Flaw in Firefox: Multiple Vulnerabilities Leading to Arbitrary Code Execution and Information Disclosure
Summary
RLSA-2026:7672: Important: firefox security update. Affects firefox versions < 0:140.9.1-1.el10_1. Fixed in 0:140.9.1-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is a widely used open-source web browser known for its commitment to standards compliance, performance, and portability. It supports various web technologies and is favored for its user privacy features. However, recent vulnerabilities have been identified that could compromise user security and system integrity.
Vulnerability Detail
The vulnerabilities stem from issues in the libpng library and memory safety bugs within Firefox and Thunderbird. Specifically, a use-after-free vulnerability (CVE-2026-33416) can lead to arbitrary code execution. Additionally, out-of-bounds read/write vulnerabilities (CVE-2026-33636) can result in information disclosure and denial of service. Memory safety bugs (CVE-2026-5731 and CVE-2026-5734) further exacerbate the risks, while an integer overflow in the Graphics: Text component (CVE-2026-5732) presents additional security concerns. The CVSS score for these vulnerabilities is 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:140.9.1-1.el10_1
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable certain features or refrain from opening untrusted websites until the update is applied. However, the best course of action is to apply the patch as soon as possible.
Conclusion
The identified vulnerabilities in Firefox pose significant risks to users, including arbitrary code execution and information disclosure. It is crucial to update to the latest patched version to mitigate these risks. Users are encouraged to remain vigilant and utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software.
See every vulnerability recorded for firefox →
FAQ
The vulnerabilities include arbitrary code execution, information disclosure, and memory safety issues, which can be exploited by attackers.
You can check your Firefox version by navigating to 'Help' > 'About Firefox'. Compare it with the patched version 0:140.9.1-1.el10_1.
If an immediate update is not possible, avoid visiting untrusted websites and disable any features that may expose you to these vulnerabilities.
Detailed information can be found on the CVE pages linked in the vulnerability report, which provide insights into the impact and technical details.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
