CVE-2026-5732 is a vulnerability caused by incorrect boundary conditions and an integer overflow within the Graphics: Text component of Mozilla Firefox. This flaw is classified under CWE-190 (Integer Overflow or Wraparound). The vulnerability was fixed in Firefox 149.0.2 and Firefox ESR 140.9.1, as well as corresponding Thunderbird versions. The issue is part of a set of memory safety bugs that showed evidence of memory corruption, which could potentially be exploited to execute arbitrary code. The CVSS v3.1 base score is 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts. Mozilla's official advisories confirm the fix and recommend upgrading to the patched versions.

The vulnerability allows an attacker to cause memory corruption through an integer overflow in the graphics text rendering component, which could lead to arbitrary code execution. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. Exploitation requires user interaction but no privileges. There are no known exploits in the wild currently.

Mozilla has released official fixes for this vulnerability in Firefox 149.0.2 and Firefox ESR 140.9.1. Users and administrators should upgrade to these versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official updates.