CVE-2026-5732 is an integer overflow vulnerability caused by incorrect boundary conditions in the Graphics: Text component of Mozilla Firefox and Thunderbird. This memory safety bug could lead to memory corruption, which attackers might exploit to execute arbitrary code. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impacts. Mozilla fixed this vulnerability in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird ESR 140.9.1. The vendor advisories (MFSA 2026-25 and MFSA 2026-27) confirm the fix and provide additional context on related memory safety bugs addressed in these releases.

Successful exploitation of this vulnerability could allow an attacker to cause memory corruption leading to arbitrary code execution with the privileges of the user running the affected application. The CVSS score of 8.8 reflects a high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, but the potential for exploitation exists due to the nature of the bug.

Mozilla has released official fixes for this vulnerability in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird ESR 140.9.1. Users and administrators should update affected products to these versions or later to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisories.