CVE-2026-16361 concerns memory safety bugs in Mozilla Firefox ESR 115.37 and 140.12. These bugs showed evidence of memory corruption, which could allow attackers, with sufficient effort, to execute arbitrary code. Mozilla released fixes for these vulnerabilities in Firefox ESR 115.38 and 140.13. The vulnerability is classified as critical with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor advisory confirms the fix and notes no known active exploitation. This vulnerability is part of multiple memory safety issues resolved in the same updates.

Successful exploitation of these memory safety bugs could lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the affected Firefox ESR installations. The CVSS score of 9.8 reflects the high impact and ease of exploitation (network attack vector, no privileges or user interaction required). No active exploitation has been observed in the wild as per the vendor advisory.

Mozilla has released official fixes for this vulnerability in Firefox ESR versions 115.38 and 140.13. Users and administrators should update affected Firefox ESR installations to these versions or later to remediate the issue. There are no alternative mitigations or workarounds indicated by the vendor advisory. Patch status is confirmed by the Mozilla security advisories MFSA 2026-69 and MFSA 2026-70.