AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-787

https://access.redhat.com/errata/RHSA-2026:10757

https://access.redhat.com/errata/RHSA-2026:10766

https://access.redhat.com/errata/RHSA-2026:10767

https://access.redhat.com/errata/RHSA-2026:12285

https://access.redhat.com/errata/RHSA-2026:13537

https://access.redhat.com/errata/RHSA-2026:15892

https://access.redhat.com/errata/RHSA-2026:17477

https://access.redhat.com/errata/RHSA-2026:17687

https://access.redhat.com/errata/RHSA-2026:17688

https://access.redhat.com/errata/RHSA-2026:17689

https://access.redhat.com/errata/RHSA-2026:17690

https://access.redhat.com/errata/RHSA-2026:19041

https://access.redhat.com/errata/RHSA-2026:19131

https://access.redhat.com/errata/RHSA-2026:19201

https://access.redhat.com/errata/RHSA-2026:19348

https://access.redhat.com/errata/RHSA-2026:19461

https://access.redhat.com/errata/RHSA-2026:19462

https://access.redhat.com/errata/RHSA-2026:19463

https://access.redhat.com/errata/RHSA-2026:19464

https://access.redhat.com/errata/RHSA-2026:19465

https://access.redhat.com/errata/RHSA-2026:19466

https://access.redhat.com/errata/RHSA-2026:19467

https://access.redhat.com/errata/RHSA-2026:19468

https://access.redhat.com/errata/RHSA-2026:19469

https://access.redhat.com/errata/RHSA-2026:19542

https://access.redhat.com/errata/RHSA-2026:19655

https://access.redhat.com/errata/RHSA-2026:19704

https://access.redhat.com/security/cve/CVE-2026-6786

https://bugzilla.redhat.com/show_bug.cgi?id=2460088

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6786.json

[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux Server (v. 7 ELS)","defaultStatus":"affected","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS (v. 10.0)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 10)","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10.1","cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","defaultStatus":"affected","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream AUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_aus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_e4s:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream TUS (v.8.6)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_tus:8.6::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.8.8)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_e4s:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream TUS (v.8.8)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_tus:8.8::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.9.0)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_e4s:9.0::appstream"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream E4S (v.9.2)","defaultStatus":"affected","cpes":["cpe:/a:redhat:rhel_e

{"timestamp":"2026-04-22T03:56:14.200175Z","id":"CVE-2026-6786","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"140.10","lessThanOrEqual":"140.*","versionType":"rpm","status":"unaffected"},{"version":"150","lessThanOrEqual":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"140.10","lessThanOrEqual":"140.*","versionType":"rpm","status":"unaffected"},{"version":"150","lessThanOrEqual":"*","versionType":"rpm","status":"unaffected"}]}]

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OR
          *cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* versions up to (excluding) 150.0
          *cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:* versions from (including) 140.0 up to (excluding) 140.10.0
          *cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:* versions from (including) 140.0 up to (excluding) 140.10.0

Mozilla Corporation: https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2019547%2C2020378%2C2022381%2C2022608%2C2022785%2C2023120%2C2023128%2C2023140%2C2023279%2C2023836%2C2023882%2C2023925%2C2023950%2C2023959%2C2023965%2C2024243%2C2024245%2C2024247%2C2024253%2C2024346%2C2024357%2C2024416%2C2024420%2C2024429%2C2024432%2C2024455%2C2024466%2C2024468%2C2024476%2C2024664%2C2024666%2C2024669%2C2024670%2C2024671%2C2024761%2C2024918%2C2025292%2C2025332%2C2025348%2C2025384%2C2025395%2C2025458%2C2025461%2C2025463%2C2025481%2C2025483%2C2025485%2C2025494%2C2025506%2C2025511%2C2025513%2C2025520%2C2026277%2C2026282%2C2026288%2C2026289%2C2026311%2C2026312%2C2026869%2C2027152%2C2027161%2C2027238%2C2027261%2C2027269%2C2027274%2C2027280%2C2027281%2C2027300%2C2027302%2C2027331%2C2027339%2C2027340%2C2027738%2C2027975%2C2028000%2C2028011%2C2028289%2C2028525%2C2028728%2C2028887%2C2028888%2C2028896%2C2029063%2C2029064%2C2029290%2C2029291%2C2029294%2C2029300%2C2029304%2C2029316%2C2029317%2C2029401%2C2029415%2C2029430%2C2029457%2C2029727%2C2029735%2C2029743%2C2029752%2C2029754%2C2029776%2C2029809%2C2030324%2C2030370 Types: Broken Link

Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-30/ Types: Vendor Advisory

Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-32/ Types: Vendor Advisory

Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-33/ Types: Vendor Advisory

Mozilla Corporation: https://www.mozilla.org/security/advisories/mfsa2026-34/ Types: Vendor Advisory

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-125

CWE-416

CWE-787

Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2019547%2C2020378%2C2022381%2C2022608%2C2022785%2C2023120%2C2023128%2C2023140%2C2023279%2C2023836%2C2023882%2C2023925%2C2023950%2C2023959%2C2023965%2C2024243%2C2024245%2C2024247%2C2024253%2C2024346%2C2024357%2C2024416%2C2024420%2C2024429%2C2024432%2C2024455%2C2024466%2C2024468%2C2024476%2C2024664%2C2024666%2C2024669%2C2024670%2C2024671%2C2024761%2C2024918%2C2025292%2C2025332%2C2025348%2C2025384%2C2025395%2C2025458%2C2025461%2C2025463%2C2025481%2C2025483%2C2025485%2C2025494%2C2025506%2C2025511%2C2025513%2C2025520%2C2026277%2C2026282%2C2026288%2C2026289%2C2026311%2C2026312%2C2026869%2C2027152%2C2027161%2C2027238%2C2027261%2C2027269%2C2027274%2C2027280%2C2027281%2C2027300%2C2027302%2C2027331%2C2027339%2C2027340%2C2027738%2C2027975%2C2028000%2C2028011%2C2028289%2C2028525%2C2028728%2C2028887%2C2028888%2C2028896%2C2029063%2C2029064%2C2029290%2C2029291%2C2029294%2C2029300%2C2029304%2C2029316%2C2029317%2C2029401%2C2029415%2C2029430%2C2029457%2C2029727%2C2029735%2C2029743%2C2029752%2C2029754%2C2029776%2C2029809%2C2030324%2C2030370

https://www.mozilla.org/security/advisories/mfsa2026-30/

https://www.mozilla.org/security/advisories/mfsa2026-32/

https://www.mozilla.org/security/advisories/mfsa2026-33/

https://www.mozilla.org/security/advisories/mfsa2026-34/