PT-2026-27421 · Mozilla · Thunderbird+1

Alex Gaynor + 6 · CVE-2026-4723 · Published 2026-03-24 · Updated 2026-07-25

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149 Thunderbird versions prior to 149

Description A use-after-free issue exists in the JavaScript Engine component. This condition may allow for unexpected behavior.

Recommendations Update Firefox to version 149 or later. Update Thunderbird to version 149 or later.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-4723

OPENSUSE-SU-2026:10458-1

OPENSUSE-SU-2026:11373-1

Affected Products

Firefox

Thunderbird

References · 283

• https://ubuntu.com/security/CVE-2026-4723 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4723 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/730268 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2026-20 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11373-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-23 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2026-20/#CVE-2026-4723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4723 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10458-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2026-20 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-4723 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4723 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2026-23 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2036552011097768136 · Twitter Post
• https://suse.com/security/cve/CVE-2025-5271 · Note