Search CVEs, research… / diras.sa
  • PoC PUBLIC

CVE-2026-74943: pre-auth remote code execution in Mozilla Firefox

A remote attacker can cause arbitrary code execution in Mozilla Firefox by triggering a use-after-free bug in the Graphics: ImageLib component (CVE-2026-74943). The vulnerability is categorized as CWE-416 and scores 9.8 CVSS 3.1, indicating attacker-controlled remote network access, no privileges or user interaction required. The facts provided do not list specific affected Firefox versions or fixed releases, so which exact releases are affected is not specified here.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.00606
CWE
CWE-416
KEV DUE DATE
Not listed
PATCH
Not yet

DIRAS TAKE

Urgent: public exploit code is available and the flaw allows remote code execution with no user interaction, so prioritize containment and patching when Mozilla issues fixes.

What is CVE-2026-74943?

A remote attacker can cause arbitrary code execution in Mozilla Firefox by triggering a use-after-free bug in the Graphics: ImageLib component (CVE-2026-74943). The vulnerability is categorized as CWE-416 and scores 9.8 CVSS 3.1, indicating attacker-controlled remote network access, no privileges or user interaction required. The facts provided do not list specific affected Firefox versions or fixed releases, so which exact releases are affected is not specified here. The weakness is classified as CWE-416 (Use After Free).

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Mozilla Firefox are affected?

BRANCHAFFECTEDFIXED

Is CVE-2026-74943 being exploited?

Public exploit code is available.

How to fix CVE-2026-74943

  1. Follow Mozilla security advisories and apply vendor updates as soon as a patch is released.
  2. Until a vendor fix is applied, reduce exposure by blocking or filtering access to untrusted sites and restrict Firefox network access where feasible.
  3. Enable and enforce automatic updates for Firefox clients and audit update status across endpoints.
  4. Monitor endpoint and network logs for exploit indicators and unusual process crashes or code execution originating from Firefox.

Frequently asked questions

Is CVE-2026-74943 being actively exploited?

Public exploit code for CVE-2026-74943 is available, but the facts provided do not include authoritative public reports that it is being actively exploited as of 2026-09-29.

Which Firefox versions are affected by CVE-2026-74943?

The facts here do not list specific affected Firefox versions; consult Mozilla's official advisory for an authoritative affected-versions list when it is published.

Is there a patch for CVE-2026-74943?

According to the provided facts, a vendor patch is not marked as available; apply vendor updates as soon as Mozilla issues a fixed release.

Does CVE-2026-74943 require authentication?

No. The provided CVSS details indicate no privileges or user interaction are required, so the flaw can be triggered without authentication.

References