Search CVEs, research… / diras.sa

CVE-2026-74940: pre-auth remote code execution in Mozilla Firefox

Remote attackers can trigger memory corruption in Mozilla Firefox that may lead to arbitrary code execution; this is tracked as CVE-2026-74940. The flaw is a use-after-free in Firefox's Graphics: Text component and carries a critical CVSS 3.1 vector indicating network attack with no privileges and no user interaction required. Vendor-specified affected version range is not listed in the provided facts, so administrators should assume vulnerable Firefox installs may be at risk until vendor updates are published.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.00606
CWE
CWE-416
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: treat as high priority because the vulnerability allows remote code execution with no authentication or user interaction, according to the CVSS vector. Restrict exposure of Firefox instances and prepare to apply vendor fixes as soon as they are released.

What is CVE-2026-74940?

Remote attackers can trigger memory corruption in Mozilla Firefox that may lead to arbitrary code execution; this is tracked as CVE-2026-74940. The flaw is a use-after-free in Firefox's Graphics: Text component and carries a critical CVSS 3.1 vector indicating network attack with no privileges and no user interaction required. Vendor-specified affected version range is not listed in the provided facts, so administrators should assume vulnerable Firefox installs may be at risk until vendor updates are published. The weakness is classified as CWE-416 (Use After Free).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Mozilla Firefox are affected?

BRANCHAFFECTEDFIXED

Is CVE-2026-74940 being exploited?

There is no CISA Known Exploited Vulnerabilities listing for this issue, and no public exploit code is available; there are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-74940

  1. Follow Mozilla advisories and apply vendor updates immediately when they are released.
  2. Restrict network exposure of Firefox installations by blocking untrusted sites and using web filtering for high-risk destinations.
  3. Monitor endpoints and security logs for browser crashes or suspicious child process activity and isolate affected hosts for investigation.
  4. Implement compensating controls such as limiting execution of untrusted content and enforcing least privilege on hosts running Firefox.

Frequently asked questions

Is CVE-2026-74940 being actively exploited?

There are no public reports of exploitation and it is not listed in the CISA KEV catalog as of 2026-09-29.

Which Firefox versions are affected by CVE-2026-74940?

The provided facts identify a use-after-free in Firefox's Graphics: Text component but do not specify which Firefox versions are affected; consult Mozilla advisories for exact version details.

Is there a patch for CVE-2026-74940?

The facts state that a patch is not available at this time; apply Mozilla updates as soon as they are published.

Does CVE-2026-74940 require authentication?

No. The vulnerability's CVSS vector indicates no privileges and no user interaction are required, so it does not require authentication to be exploited.

References