CVE-2026-74943 is a use-after-free vulnerability affecting the Graphics: ImageLib component in Mozilla Firefox and Thunderbird. Use-after-free bugs occur when a program continues to use a pointer after the memory it points to has been freed, potentially leading to memory corruption and arbitrary code execution. This vulnerability was identified and fixed in Firefox 154 and corresponding ESR and Thunderbird versions. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisories from Mozilla confirm the fix and provide multiple bug references for this and related vulnerabilities.

The vulnerability allows remote attackers to cause memory corruption through use-after-free in the Graphics: ImageLib component, potentially leading to arbitrary code execution or denial of service. The CVSS score of 9.8 indicates critical severity with high impact on confidentiality, integrity, and availability. No active exploitation has been reported, but the nature of the flaw suggests a serious risk if left unpatched.

Mozilla has released official fixes for this vulnerability in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. Users and administrators should update to these versions or later to mitigate the risk. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisories.