CVE-2026-14241
published 2026-06-30CVE-2026-14241: Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.43%
35.8th percentile
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | < Firefox 152.0.4 | Firefox 152.0.4 |
| mozilla | firefox | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: Memory safety bugs fixed in Firefox 152.0.4
vendor_redhat·2026-06-30·CVSS 9.8
CVE-2026-14241 [CRITICAL] CWE-787 firefox: Memory safety bugs fixed in Firefox 152.0.4
firefox: Memory safety bugs fixed in Firefox 152.0.4
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue:
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: firefox (Red Hat Enterprise Linux 10) - Not a
Mozilla
Mozilla Foundation Security Advisory 2026-62: CVE-2026-14241
vendor_mozilla
CVE-2026-14241 Mozilla Foundation Security Advisory 2026-62: CVE-2026-14241
Mozilla Foundation Security Advisory 2026-62
CVE: CVE-2026-14241
Product: Firefox
Impact: high
Fixed in: Firefox 152.0.4
GHSA
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
ghsa·2026-10-07
CVE-2026-107218 [MEDIUM] CWE-129 Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics
`leftRight` (calc.go:14236) tests the length with `countUTF16String`, which counts a rune above U+FFFF as 2. The RIGHT branch on 14241 then slices `[]rune(text)` at `utf8.RuneCountInString(text)-numChars`, which counts it as 1. For text with N such runes the two measures are 2N and N, so any `numChars` between them passes the guard and gives a negative index. The `numChars < 0` check at 14216 does not help, since the value that gets through is positive.
What makes it worth reporting is `AutoFitColWidth`, which evaluates formulas without looking like it does, so normalising an uploaded sheet is enough to reach it. One scoping correction to my own wording there: `AutoFitColWidth` was added in v2.11.0 and
GHSA
Memory safety bugs present in Firefox 152.0.3.
ghsa_unreviewed·2026-06-30
CVE-2026-14241 [CRITICAL] CWE-787 Memory safety bugs present in Firefox 152.0.3.
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.
VulDB
Mozilla Firefox up to 152.0.3 memory corruption (EUVD-2026-40321)
vuldb·2026-06-30
CVE-2026-14241 [CRITICAL] Mozilla Firefox up to 152.0.3 memory corruption (EUVD-2026-40321)
A vulnerability was found in Mozilla Firefox up to 152.0.3. It has been rated as critical. The impacted element is an unknown function. The manipulation leads to memory corruption.
This vulnerability is listed as CVE-2026-14241. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-06-30
Published