CVE-2026-0891

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

High · published January 13, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

⚡ Memory safety bugs are lurking in Firefox and Thunderbird, just waiting for the right moment to pounce! 🦇 Think of these memory safety bugs as loose wires in a factory. One misplaced connection can cause chaos on the production line, potentially leading to a runaway machine that does whatever it wants! If exploited, an attacker could commandeer the application, executing malicious code at will. This could mean unauthorized access to sensitive data or even full control over a compromised system — a nightmare scenario for any user!

Put simply

Think of these memory safety bugs as loose wires in a factory. One misplaced connection can cause chaos on the production line, potentially leading to a runaway machine that does whatever it wants! In the affected versions of Firefox and Thunderbird, memory corruption issues were identified that could allow an attacker to execute arbitrary code remotely, compromising the integrity of the applications.

What to do

If exploited, an attacker could commandeer the application, executing malicious code at will. This could mean unauthorized access to sensitive data or even full control over a compromised system — a nightmare scenario for any user! To keep your systems secure, update to Firefox 147, Firefox ESR 140.7, Thunderbird 147, or Thunderbird 140.7 as soon as possible. Performing routine checks for software updates will help you stay protected in the future! You’ve got this! Follow these steps and you’ll ensure a safer browsing experience for everyone! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Published
2026-01-13T13:30Z
EPSS history
Timeline
  • 13 JAN 13:30Z
    Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
    cvelistv5