CVE-2026-16360
Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
No public exploitation has been reported so far. A fixed version is available (see the table below).
Recommended action: Update to the fixed version listed for your distribution using the native package manager.
Severity metrics
CVSS 3.1 : 9.8 CRITICAL
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected & fixed versions by distribution
Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.
| Distribution | Package | Affected | Fixed version | Status |
|---|---|---|---|---|
| Debian:11 | firefox-esr | - | 140.13.0esr-1~deb11u1 | fixed |
| Debian:12 | firefox-esr | - | 140.13.0esr-1~deb12u1 | fixed |
| Debian:13 | firefox-esr | - | 140.13.0esr-1~deb13u1 | fixed |
| Debian:14 | firefox-esr | - | 140.13.0esr-1 | fixed |
| Debian:11 | thunderbird | - | - | affected (no fix yet) |
| Debian:12 | thunderbird | - | - | affected (no fix yet) |
| Debian:13 | thunderbird | - | - | affected (no fix yet) |
| Debian:14 | thunderbird | - | - | affected (no fix yet) |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | MozillaFirefox | - | 140.13.0-112.324.2 | fixed |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | MozillaFirefox | - | 140.13.0-112.324.2 | fixed |
| SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | MozillaFirefox | - | 140.13.0-150200.152.248.1 | fixed |
| openSUSE:Tumbleweed | MozillaFirefox | - | 153.0-1.1 | fixed |
| openSUSE:Tumbleweed | MozillaThunderbird | - | 140.13.0-1.1 | fixed |
| openSUSE:Tumbleweed | firefox-esr | - | 140.13.0-1.1 | fixed |