Critical severity9.8NVD Advisory· Published Aug 18, 2026· Updated Sep 1, 2026

CVE-2026-74989

Description

Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefoxllm-fuzzy
Range: <154
Mozilla Corporation/Thunderbirdllm-fuzzy
Range: <154
osv-coords5 versions
pkg:apk/chainguard/firefox pkg:apk/chainguard/firefox-docker-selenium-compat pkg:apk/wolfi/firefox pkg:apk/wolfi/firefox-docker-selenium-compat pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed
< 154.0-r0+ 4 more
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 154.0-r0
- (no CPE)range: < 154.0-1.1

Patches

Vulnerability mechanics

References

www.mozilla.org/security/advisories/mfsa2026-74/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2026-78/nvdVendor Advisory
bugzilla.mozilla.org/buglist.cginvdNot Applicable
bugzilla.mozilla.org/buglist.cginvdNot Applicable

News mentions

Mozilla Thunderbird: 25 Vulnerabilities Disclosed, Ranging from Critical to Medium Severity
Vypr Intelligence · Aug 18, 2026

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000