Vulnerability-Lookup

ALSA-2026:93443 (CVE-2026-109704)

Vulnerability from osv_almalinux – Published: 2026-11-02 00:00 – Updated: 2026-11-02 08:58 – Source website

Summary

Important: thunderbird security, bug fix, and enhancement update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

libexpat: denial of service via crafted XML input (CVE-2026-45186)
firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109764)
firefox: Spoofing issue in the DOM: Web Serial component (CVE-2026-109770)
firefox: Mitigation bypass in the File Handling component (CVE-2026-109783)
firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)
firefox: Use-after-free in the XML component (CVE-2026-109718)
firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)
firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)
firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)
firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)
firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109724)
firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)
firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)
firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)
firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)
firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)
firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)
firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)
firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)
firefox: Other issue in the DOM: File component (CVE-2026-109744)
firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)
firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)
firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)
firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)
firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)
firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)
firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-109734)
firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)
firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)
firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)
firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)
firefox: Race condition in the XPCOM component (CVE-2026-109776)
firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)
firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)
firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)
firefox: Information disclosure in the Storage: IndexedDB component (CVE-2026-109777)
firefox: Use-after-free in the SVG component (CVE-2026-109726)
firefox: Integer overflow in the Graphics component (CVE-2026-109730)
firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)
firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)
firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109766)
firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)
firefox: Site isolation issue in the Networking component (CVE-2026-109759)
firefox: Privilege escalation in the WebExtensions component (CVE-2026-109778)
firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762)
firefox: Race condition, use-after-free in the Graphics: Text component (CVE-2026-109765)
firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754)
firefox: Information disclosure in the Networking component (CVE-2026-109751)
firefox: Use-after-free in the DOM: Core & HTML component (CVE-2026-109725)
firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)
firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)
firefox: Frame poisoning in the Layout component (CVE-2026-109736)
firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)
firefox: Information disclosure in the Networking component (CVE-2026-109767)
firefox: Denial-of-service in the WebRTC component (CVE-2026-109775)
firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)
firefox: Denial-of-service in the Printing: Output component (CVE-2026-109781)
firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-109710)
firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-109731)
firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)
firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743)

Bug Fix(es) and Enhancement(s):

Thunderbird ESR 153 rebase [rhel-9.8.z] (JIRA:RHEL-175199)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2026:93443	ADVISORY
	https://access.redhat.com/security/cve/CVE-2026-109704	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109705	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109706	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109707	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109708	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109709	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109710	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109711	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109712	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109713	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109715	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109716	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109717	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109718	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109719	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109720	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109721	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109722	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109723	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109724	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109725	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109726	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109727	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109728	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109729	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109730	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109731	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109732	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109733	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109734	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109736	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109737	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109738	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109740	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109741	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109742	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109743	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109744	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109745	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109751	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109752	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109753	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109754	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109756	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109757	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109759	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109760	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109762	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109763	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109764	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109765	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109766	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109767	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109770	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109775	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109776	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109777	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109778	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109781	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109782	REPORT
	https://access.redhat.com/security/cve/CVE-2026-109783	REPORT
	https://access.redhat.com/security/cve/CVE-2026-45186	REPORT
	https://bugzilla.redhat.com/2468575	REPORT
	https://bugzilla.redhat.com/2550393	REPORT
	https://bugzilla.redhat.com/2550394	REPORT
	https://bugzilla.redhat.com/2550396	REPORT
	https://bugzilla.redhat.com/2550397	REPORT
	https://bugzilla.redhat.com/2550400	REPORT
	https://bugzilla.redhat.com/2550401	REPORT
	https://bugzilla.redhat.com/2550403	REPORT
	https://bugzilla.redhat.com/2550404	REPORT
	https://bugzilla.redhat.com/2550405	REPORT
	https://bugzilla.redhat.com/2550406	REPORT
	https://bugzilla.redhat.com/2550408	REPORT
	https://bugzilla.redhat.com/2550410	REPORT
	https://bugzilla.redhat.com/2550411	REPORT
	https://bugzilla.redhat.com/2550412	REPORT
	https://bugzilla.redhat.com/2550413	REPORT
	https://bugzilla.redhat.com/2550417	REPORT
	https://bugzilla.redhat.com/2550418	REPORT
	https://bugzilla.redhat.com/2550419	REPORT
	https://bugzilla.redhat.com/2550420	REPORT
	https://bugzilla.redhat.com/2550421	REPORT
	https://bugzilla.redhat.com/2550422	REPORT
	https://bugzilla.redhat.com/2550424	REPORT
	https://bugzilla.redhat.com/2550425	REPORT
	https://bugzilla.redhat.com/2550426	REPORT
	https://bugzilla.redhat.com/2550428	REPORT
	https://bugzilla.redhat.com/2550429	REPORT
	https://bugzilla.redhat.com/2550430	REPORT
	https://bugzilla.redhat.com/2550431	REPORT
	https://bugzilla.redhat.com/2550432	REPORT
	https://bugzilla.redhat.com/2550433	REPORT
	https://bugzilla.redhat.com/2550434	REPORT
	https://bugzilla.redhat.com/2550436	REPORT
	https://bugzilla.redhat.com/2550438	REPORT
	https://bugzilla.redhat.com/2550440	REPORT
	https://bugzilla.redhat.com/2550442	REPORT
	https://bugzilla.redhat.com/2550444	REPORT
	https://bugzilla.redhat.com/2550446	REPORT
	https://bugzilla.redhat.com/2550450	REPORT
	https://bugzilla.redhat.com/2550451	REPORT
	https://bugzilla.redhat.com/2550452	REPORT
	https://bugzilla.redhat.com/2550454	REPORT
	https://bugzilla.redhat.com/2550455	REPORT
	https://bugzilla.redhat.com/2550458	REPORT
	https://bugzilla.redhat.com/2550459	REPORT
	https://bugzilla.redhat.com/2550461	REPORT
	https://bugzilla.redhat.com/2550463	REPORT
	https://bugzilla.redhat.com/2550464	REPORT
	https://bugzilla.redhat.com/2550465	REPORT
	https://bugzilla.redhat.com/2550467	REPORT
	https://bugzilla.redhat.com/2550468	REPORT
	https://bugzilla.redhat.com/2550469	REPORT
	https://bugzilla.redhat.com/2550470	REPORT
	https://bugzilla.redhat.com/2550471	REPORT
	https://bugzilla.redhat.com/2550472	REPORT
	https://bugzilla.redhat.com/2550473	REPORT
	https://bugzilla.redhat.com/2550474	REPORT
	https://bugzilla.redhat.com/2550475	REPORT
	https://bugzilla.redhat.com/2550476	REPORT
	https://bugzilla.redhat.com/2550477	REPORT
	https://bugzilla.redhat.com/2550478	REPORT
	https://bugzilla.redhat.com/2550480	REPORT
	https://errata.almalinux.org/9/ALSA-2026-93443.html	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "thunderbird"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "153.5.0-1.el9_8.alma.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * libexpat: denial of service via crafted XML input (CVE-2026-45186)\n  * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109764)\n  * firefox: Spoofing issue in the DOM: Web Serial component (CVE-2026-109770)\n  * firefox: Mitigation bypass in the File Handling component (CVE-2026-109783)\n  * firefox: thunderbird: Privilege escalation in the Application Update component (CVE-2026-109704)\n  * firefox: Use-after-free in the XML component (CVE-2026-109718)\n  * firefox: Information disclosure in the PDF Viewer component (CVE-2026-109742)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109715)\n  * firefox: firefox: Sandbox escape via incorrect boundary conditions in Win32 widget (CVE-2026-109740)\n  * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-109706)\n  * firefox: Use-after-free in the Crash Reporting component (CVE-2026-109713)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109724)\n  * firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component (CVE-2026-109745)\n  * firefox: Mitigation bypass in the File Handling component (CVE-2026-109782)\n  * firefox: Information disclosure, privilege escalation in the Security: Process Sandboxing component (CVE-2026-109709)\n  * firefox: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (CVE-2026-109705)\n  * firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-109738)\n  * firefox: Sandbox escape due to race condition in the Networking component (CVE-2026-109757)\n  * firefox: Use-after-free in the Storage: Bucket File System component (CVE-2026-109741)\n  * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-109729)\n  * firefox: Other issue in the DOM: File component (CVE-2026-109744)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-109716)\n  * firefox: Race condition, use-after-free in the Graphics: CanvasWebGL component (CVE-2026-109719)\n  * firefox: Incorrect boundary conditions in the Layout component (CVE-2026-109753)\n  * firefox: Integer overflow in the Layout: Text and Fonts component (CVE-2026-109723)\n  * firefox: Privilege escalation in the DOM: Navigation component (CVE-2026-109756)\n  * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109733)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-109734)\n  * firefox: Mitigation bypass in the File Handling component (CVE-2026-109763)\n  * firefox: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-109708)\n  * firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-109717)\n  * firefox: Use-after-free in the DOM: Workers component (CVE-2026-109752)\n  * firefox: Race condition in the XPCOM component (CVE-2026-109776)\n  * firefox: Sandbox escape due to use-after-free in the Networking component (CVE-2026-109707)\n  * firefox: Mitigation bypass in the Networking: HTTP component (CVE-2026-109760)\n  * firefox: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-109720)\n  * firefox: Information disclosure in the Storage: IndexedDB component (CVE-2026-109777)\n  * firefox: Use-after-free in the SVG component (CVE-2026-109726)\n  * firefox: Integer overflow in the Graphics component (CVE-2026-109730)\n  * firefox: Use-after-free in the Audio/Video component (CVE-2026-109727)\n  * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109737)\n  * firefox: Mitigation bypass in the Enterprise Policies component (CVE-2026-109766)\n  * firefox: Use-after-free in the DOM: Streams component (CVE-2026-109732)\n  * firefox: Site isolation issue in the Networking component (CVE-2026-109759)\n  * firefox: Privilege escalation in the WebExtensions component (CVE-2026-109778)\n  * firefox: Incorrect boundary conditions in the SVG component (CVE-2026-109762)\n  * firefox: Race condition, use-after-free in the Graphics: Text component (CVE-2026-109765)\n  * firefox: Incorrect boundary conditions in the DOM: Editor component (CVE-2026-109754)\n  * firefox: Information disclosure in the Networking component (CVE-2026-109751)\n  * firefox: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-109725)\n  * firefox: Sandbox escape due to uninitialized memory in the Graphics component (CVE-2026-109712)\n  * firefox: Use-after-free in the Graphics: Canvas2D component (CVE-2026-109711)\n  * firefox: Frame poisoning in the Layout component (CVE-2026-109736)\n  * firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-109722)\n  * firefox: Information disclosure in the Networking component (CVE-2026-109767)\n  * firefox: Denial-of-service in the WebRTC component (CVE-2026-109775)\n  * firefox: Use-after-free in the DOM: Animation component (CVE-2026-109728)\n  * firefox: Denial-of-service in the Printing: Output component (CVE-2026-109781)\n  * firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-109710)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-109731)\n  * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-109721)\n  * firefox: Privilege escalation in the Panning and Zooming component (CVE-2026-109743)\n\n\nBug Fix(es) and Enhancement(s):  \n\n  * Thunderbird ESR 153 rebase [rhel-9.8.z] (JIRA:RHEL-175199)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:93443",
  "modified": "2026-11-02T08:58:41Z",
  "published": "2026-11-02T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:93443"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109704"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109705"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109706"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109707"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109708"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109709"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109710"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109711"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109712"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109713"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109715"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109716"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109717"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109718"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109719"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109720"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109721"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109722"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109723"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109724"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109725"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109726"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109727"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109728"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109729"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109730"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109731"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109732"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109733"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109734"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109736"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109737"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109738"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109740"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109741"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109742"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109743"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109744"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109745"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109751"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109752"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109753"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109754"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109756"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109757"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109759"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109760"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109762"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109763"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109764"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109765"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109766"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109767"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109770"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109775"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109776"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109777"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109778"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109781"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109782"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-109783"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-45186"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2468575"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550393"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550394"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550396"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550397"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550400"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550401"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550403"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550404"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550405"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550406"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550408"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550410"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550411"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550412"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550413"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550417"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550418"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550419"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550420"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550421"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550422"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550424"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550425"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550426"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550428"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550429"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550430"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550431"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550432"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550433"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550434"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550436"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550438"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550440"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550442"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550444"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550446"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550450"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550451"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550452"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550454"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550455"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550458"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550459"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550461"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550464"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550465"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550467"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550468"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550469"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550470"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550471"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550472"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550473"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550474"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550475"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550476"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550477"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550478"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2550480"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-93443.html"
    }
  ],
  "related": [
    "CVE-2026-109704",
    "CVE-2026-109705",
    "CVE-2026-109706",
    "CVE-2026-109707",
    "CVE-2026-109708",
    "CVE-2026-109709",
    "CVE-2026-109710",
    "CVE-2026-109711",
    "CVE-2026-109712",
    "CVE-2026-109713",
    "CVE-2026-109715",
    "CVE-2026-109716",
    "CVE-2026-109717",
    "CVE-2026-109718",
    "CVE-2026-109719",
    "CVE-2026-109720",
    "CVE-2026-109721",
    "CVE-2026-109722",
    "CVE-2026-109723",
    "CVE-2026-109724",
    "CVE-2026-109725",
    "CVE-2026-109726",
    "CVE-2026-109727",
    "CVE-2026-109728",
    "CVE-2026-109729",
    "CVE-2026-109730",
    "CVE-2026-109731",
    "CVE-2026-109732",
    "CVE-2026-109733",
    "CVE-2026-109734",
    "CVE-2026-109736",
    "CVE-2026-109737",
    "CVE-2026-109738",
    "CVE-2026-109740",
    "CVE-2026-109741",
    "CVE-2026-109742",
    "CVE-2026-109743",
    "CVE-2026-109744",
    "CVE-2026-109745",
    "CVE-2026-109751",
    "CVE-2026-109752",
    "CVE-2026-109753",
    "CVE-2026-109754",
    "CVE-2026-109756",
    "CVE-2026-109757",
    "CVE-2026-109759",
    "CVE-2026-109760",
    "CVE-2026-109762",
    "CVE-2026-109763",
    "CVE-2026-109764",
    "CVE-2026-109765",
    "CVE-2026-109766",
    "CVE-2026-109767",
    "CVE-2026-109770",
    "CVE-2026-109775",
    "CVE-2026-109776",
    "CVE-2026-109777",
    "CVE-2026-109778",
    "CVE-2026-109781",
    "CVE-2026-109782",
    "CVE-2026-109783",
    "CVE-2026-45186"
  ],
  "schema_version": "1.7.0",
  "summary": "Important: thunderbird security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-109704",
    "CVE-2026-109705",
    "CVE-2026-109706",
    "CVE-2026-109707",
    "CVE-2026-109708",
    "CVE-2026-109709",
    "CVE-2026-109710",
    "CVE-2026-109711",
    "CVE-2026-109712",
    "CVE-2026-109713",
    "CVE-2026-109715",
    "CVE-2026-109716",
    "CVE-2026-109717",
    "CVE-2026-109718",
    "CVE-2026-109719",
    "CVE-2026-109720",
    "CVE-2026-109721",
    "CVE-2026-109722",
    "CVE-2026-109723",
    "CVE-2026-109724",
    "CVE-2026-109725",
    "CVE-2026-109726",
    "CVE-2026-109727",
    "CVE-2026-109728",
    "CVE-2026-109729",
    "CVE-2026-109730",
    "CVE-2026-109731",
    "CVE-2026-109732",
    "CVE-2026-109733",
    "CVE-2026-109734",
    "CVE-2026-109736",
    "CVE-2026-109737",
    "CVE-2026-109738",
    "CVE-2026-109740",
    "CVE-2026-109741",
    "CVE-2026-109742",
    "CVE-2026-109743",
    "CVE-2026-109744",
    "CVE-2026-109745",
    "CVE-2026-109751",
    "CVE-2026-109752",
    "CVE-2026-109753",
    "CVE-2026-109754",
    "CVE-2026-109756",
    "CVE-2026-109757",
    "CVE-2026-109759",
    "CVE-2026-109760",
    "CVE-2026-109762",
    "CVE-2026-109763",
    "CVE-2026-109764",
    "CVE-2026-109765",
    "CVE-2026-109766",
    "CVE-2026-109767",
    "CVE-2026-109770",
    "CVE-2026-109775",
    "CVE-2026-109776",
    "CVE-2026-109777",
    "CVE-2026-109778",
    "CVE-2026-109781",
    "CVE-2026-109782",
    "CVE-2026-109783",
    "CVE-2026-45186"
  ]
}

CVE-2026-109736 (GCVE-0-2026-109736)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-19 11:39

Title

Frame poisoning in the Layout component

Summary

Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 11:38 UTC

CWE

CWE-451 - User Interface (UI) Misrepresentation of Critical Information

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2029784
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109736",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T11:38:55.633860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-451",
                "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T11:39:17.408Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:00.327Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2029784"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Frame poisoning in the Layout component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109736",
    "datePublished": "2026-10-13T12:29:25.182Z",
    "dateReserved": "2026-10-13T00:29:42.815Z",
    "dateUpdated": "2026-10-19T11:39:17.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109737 (GCVE-0-2026-109737)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-19 11:45

Title

Mitigation bypass in the Enterprise Policies component

Summary

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 11:43 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2044525
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Souma Ohsawa

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T11:43:26.089257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-693",
                "description": "CWE-693 Protection Mechanism Failure",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T11:45:28.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Souma Ohsawa"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:01.365Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2044525"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Mitigation bypass in the Enterprise Policies component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109737",
    "datePublished": "2026-10-13T12:29:25.392Z",
    "dateReserved": "2026-10-13T00:29:43.626Z",
    "dateUpdated": "2026-10-19T11:45:28.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109738 (GCVE-0-2026-109738)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17

Title

Use-after-free in the Audio/Video: Playback component

Summary

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2047722
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109738",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:05.593269Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:49.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:02.358Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2047722"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Audio/Video: Playback component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109738",
    "datePublished": "2026-10-13T12:29:25.626Z",
    "dateReserved": "2026-10-13T00:29:44.487Z",
    "dateUpdated": "2026-10-13T18:17:02.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109740 (GCVE-0-2026-109740)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-19 11:52

Title

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Summary

Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 11:51 UTC

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2057113
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T11:51:05.678002Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-119",
                "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T11:52:04.550Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:03.396Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2057113"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109740",
    "datePublished": "2026-10-13T12:29:26.143Z",
    "dateReserved": "2026-10-13T00:29:46.134Z",
    "dateUpdated": "2026-10-19T11:52:04.550Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109741 (GCVE-0-2026-109741)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17

Title

Use-after-free in the Storage: Bucket File System component

Summary

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:13 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2058651
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109741",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:13:40.267437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:18:51.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:04.429Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2058651"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Use-after-free in the Storage: Bucket File System component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109741",
    "datePublished": "2026-10-13T12:29:26.413Z",
    "dateReserved": "2026-10-13T00:29:46.940Z",
    "dateUpdated": "2026-10-13T18:17:04.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109742 (GCVE-0-2026-109742)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17

Title

Information disclosure in the PDF Viewer component

Summary

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:57 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2058800
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:57:52.168479Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:59:23.034Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:05.468Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2058800"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Information disclosure in the PDF Viewer component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109742",
    "datePublished": "2026-10-13T12:29:26.614Z",
    "dateReserved": "2026-10-13T00:29:47.751Z",
    "dateUpdated": "2026-10-13T18:17:05.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109743 (GCVE-0-2026-109743)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-14 15:56

Title

Privilege escalation in the Panning and Zooming component

Summary

Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-14 03:59 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059195
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109743",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-14T03:59:05.957469Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-14T15:56:09.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:06.463Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059195"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Privilege escalation in the Panning and Zooming component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109743",
    "datePublished": "2026-10-13T12:29:26.898Z",
    "dateReserved": "2026-10-13T00:29:48.572Z",
    "dateUpdated": "2026-10-14T15:56:09.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109744 (GCVE-0-2026-109744)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-19 11:57

Title

Other issue in the DOM: File component

Summary

Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 11:57 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2059211
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T11:57:46.827707Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T11:57:52.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:07.460Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2059211"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Other issue in the DOM: File component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109744",
    "datePublished": "2026-10-13T12:29:27.136Z",
    "dateReserved": "2026-10-13T00:29:49.395Z",
    "dateUpdated": "2026-10-19T11:57:52.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109745 (GCVE-0-2026-109745)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-19 12:09

Title

Sandbox escape due to uninitialized memory in the DOM: Web Serial component

Summary

Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

9.6 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 12:09 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2061784
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.6,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T12:09:08.809775Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T12:09:25.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Sandbox escape due to uninitialized memory in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:08.464Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2061784"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Sandbox escape due to uninitialized memory in the DOM: Web Serial component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109745",
    "datePublished": "2026-10-13T12:29:27.405Z",
    "dateReserved": "2026-10-13T00:29:50.232Z",
    "dateUpdated": "2026-10-19T12:09:25.531Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109751 (GCVE-0-2026-109751)

Vulnerability from cvelistv5 – Published: 2026-10-13 12:29 – Updated: 2026-10-13 18:17

Title

Information disclosure in the Networking component

Summary

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 14:07 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

mozilla CNA under the mitre root

CNA scorecard E 38/100 over 683 records in the last 180 days details

References

5 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2068372
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)
Mozilla	Thunderbird	Unaffected: 153.5 , ≤ 153.* (rpm) Unaffected: 158 , ≤ * (rpm)

Credits

Mozilla

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-109751",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T14:07:46.625342Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T14:07:49.959Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        },
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.5",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "158",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Mozilla"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
            }
          ],
          "value": "Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:17:10.513Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2068372"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-106/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-108/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-110/"
        }
      ],
      "title": "Information disclosure in the Networking component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-109751",
    "datePublished": "2026-10-13T12:29:29.064Z",
    "dateReserved": "2026-10-13T00:29:56.187Z",
    "dateUpdated": "2026-10-13T18:17:10.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2026:93443 (CVE-2026-109704)

CVE-2026-109736 (GCVE-0-2026-109736)

CVE-2026-109737 (GCVE-0-2026-109737)

CVE-2026-109738 (GCVE-0-2026-109738)

CVE-2026-109740 (GCVE-0-2026-109740)

CVE-2026-109741 (GCVE-0-2026-109741)

CVE-2026-109742 (GCVE-0-2026-109742)

CVE-2026-109743 (GCVE-0-2026-109743)

CVE-2026-109744 (GCVE-0-2026-109744)

CVE-2026-109745 (GCVE-0-2026-109745)

CVE-2026-109751 (GCVE-0-2026-109751)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour