CVE-2026-8949

HighCVSS 7.5

Published: 19/05/2026(UTC)Updated: 14/10/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

48th percentile - higher than 48% of all known CVEs

Summary

Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Risk Assessment

Integer overflow can lead to unexpected application behavior, posing a risk to user data security.

Recommendation

It is recommended to update to the latest versions of Firefox and Thunderbird to mitigate this vulnerability.

Other vulnerabilities in Widget: Win32

CVE-2026-8959Critical
CVE-2026-8959 is a vulnerability due to incorrect boundary conditions in the Widget: Win32 component, allowing for sandbox escape. It has been fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Original NVD description (English source)

Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS