Refine your search
1924 vulnerabilities found for Thunderbird by Mozilla
CERTFR-2026-AVI-1406
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Mozilla | Firefox | Firefox versions antérieures à 159 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 153.6 | ||
| Mozilla | Firefox ESR | Firefox ESR versions antérieures à 115.44 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 153.6 | ||
| Mozilla | Thunderbird | Thunderbird versions antérieures à 159 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firefox versions ant\u00e9rieures \u00e0 159",
"product": {
"name": "Firefox",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 153.6",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Firefox ESR versions ant\u00e9rieures \u00e0 115.44",
"product": {
"name": "Firefox ESR",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 153.6",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
},
{
"description": "Thunderbird versions ant\u00e9rieures \u00e0 159",
"product": {
"name": "Thunderbird",
"vendor": {
"name": "Mozilla",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-117907",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117907"
},
{
"name": "CVE-2026-117889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117889"
},
{
"name": "CVE-2026-117988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117988"
},
{
"name": "CVE-2026-117865",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117865"
},
{
"name": "CVE-2026-117967",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117967"
},
{
"name": "CVE-2026-117914",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117914"
},
{
"name": "CVE-2026-117956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117956"
},
{
"name": "CVE-2026-117900",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117900"
},
{
"name": "CVE-2026-117868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117868"
},
{
"name": "CVE-2026-117960",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117960"
},
{
"name": "CVE-2026-117882",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117882"
},
{
"name": "CVE-2026-117953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117953"
},
{
"name": "CVE-2026-118179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118179"
},
{
"name": "CVE-2026-117996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117996"
},
{
"name": "CVE-2026-117962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117962"
},
{
"name": "CVE-2026-117948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117948"
},
{
"name": "CVE-2026-117910",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117910"
},
{
"name": "CVE-2026-117915",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117915"
},
{
"name": "CVE-2026-117888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117888"
},
{
"name": "CVE-2026-117935",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117935"
},
{
"name": "CVE-2026-117899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117899"
},
{
"name": "CVE-2026-118027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118027"
},
{
"name": "CVE-2026-118026",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118026"
},
{
"name": "CVE-2026-117983",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117983"
},
{
"name": "CVE-2026-117972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117972"
},
{
"name": "CVE-2026-117920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117920"
},
{
"name": "CVE-2026-118014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118014"
},
{
"name": "CVE-2026-117979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117979"
},
{
"name": "CVE-2026-117871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117871"
},
{
"name": "CVE-2026-117973",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117973"
},
{
"name": "CVE-2026-118017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118017"
},
{
"name": "CVE-2026-117878",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117878"
},
{
"name": "CVE-2026-118174",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118174"
},
{
"name": "CVE-2026-117965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117965"
},
{
"name": "CVE-2026-117952",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117952"
},
{
"name": "CVE-2026-118005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118005"
},
{
"name": "CVE-2026-117863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117863"
},
{
"name": "CVE-2026-118006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118006"
},
{
"name": "CVE-2026-117969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117969"
},
{
"name": "CVE-2026-118024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118024"
},
{
"name": "CVE-2026-117867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117867"
},
{
"name": "CVE-2026-117997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117997"
},
{
"name": "CVE-2026-117925",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117925"
},
{
"name": "CVE-2026-117860",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117860"
},
{
"name": "CVE-2026-117864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117864"
},
{
"name": "CVE-2026-118004",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118004"
},
{
"name": "CVE-2026-109707",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109707"
},
{
"name": "CVE-2026-117934",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117934"
},
{
"name": "CVE-2026-117879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117879"
},
{
"name": "CVE-2026-117872",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117872"
},
{
"name": "CVE-2026-117869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117869"
},
{
"name": "CVE-2026-117942",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117942"
},
{
"name": "CVE-2026-117957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117957"
},
{
"name": "CVE-2026-117912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117912"
},
{
"name": "CVE-2026-117950",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117950"
},
{
"name": "CVE-2026-117990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117990"
},
{
"name": "CVE-2026-117991",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117991"
},
{
"name": "CVE-2026-109708",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109708"
},
{
"name": "CVE-2026-117924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117924"
},
{
"name": "CVE-2026-117931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117931"
},
{
"name": "CVE-2026-117911",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117911"
},
{
"name": "CVE-2026-118019",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118019"
},
{
"name": "CVE-2026-110247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-110247"
},
{
"name": "CVE-2026-118012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118012"
},
{
"name": "CVE-2026-117982",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117982"
},
{
"name": "CVE-2026-117909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117909"
},
{
"name": "CVE-2026-117984",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117984"
},
{
"name": "CVE-2026-100801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100801"
},
{
"name": "CVE-2026-117901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117901"
},
{
"name": "CVE-2026-117897",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117897"
},
{
"name": "CVE-2026-117964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117964"
},
{
"name": "CVE-2026-117978",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117978"
},
{
"name": "CVE-2026-117999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117999"
},
{
"name": "CVE-2026-118008",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118008"
},
{
"name": "CVE-2026-117939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117939"
},
{
"name": "CVE-2026-118007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118007"
},
{
"name": "CVE-2026-118011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118011"
},
{
"name": "CVE-2026-117946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117946"
},
{
"name": "CVE-2026-117913",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117913"
},
{
"name": "CVE-2026-118016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118016"
},
{
"name": "CVE-2026-117898",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117898"
},
{
"name": "CVE-2026-117922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117922"
},
{
"name": "CVE-2026-117977",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117977"
},
{
"name": "CVE-2026-117992",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117992"
},
{
"name": "CVE-2026-117885",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117885"
},
{
"name": "CVE-2026-117927",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117927"
},
{
"name": "CVE-2026-117976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117976"
},
{
"name": "CVE-2026-117928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117928"
},
{
"name": "CVE-2026-117894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117894"
},
{
"name": "CVE-2026-117937",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117937"
},
{
"name": "CVE-2026-117921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117921"
},
{
"name": "CVE-2026-109705",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-109705"
},
{
"name": "CVE-2026-117987",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117987"
},
{
"name": "CVE-2026-117874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117874"
},
{
"name": "CVE-2026-118009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118009"
},
{
"name": "CVE-2026-117974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117974"
},
{
"name": "CVE-2026-117981",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117981"
},
{
"name": "CVE-2026-117963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117963"
},
{
"name": "CVE-2026-117970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117970"
},
{
"name": "CVE-2026-117884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117884"
},
{
"name": "CVE-2026-118022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118022"
},
{
"name": "CVE-2026-118177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118177"
},
{
"name": "CVE-2026-117929",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117929"
},
{
"name": "CVE-2026-117985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117985"
},
{
"name": "CVE-2026-117891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117891"
},
{
"name": "CVE-2026-117959",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117959"
},
{
"name": "CVE-2026-117883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117883"
},
{
"name": "CVE-2026-117892",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117892"
},
{
"name": "CVE-2026-117866",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117866"
},
{
"name": "CVE-2026-117861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117861"
},
{
"name": "CVE-2026-117938",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117938"
},
{
"name": "CVE-2026-117933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117933"
},
{
"name": "CVE-2026-117943",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117943"
},
{
"name": "CVE-2026-117923",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117923"
},
{
"name": "CVE-2026-117954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117954"
},
{
"name": "CVE-2026-117966",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117966"
},
{
"name": "CVE-2026-117945",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117945"
},
{
"name": "CVE-2026-118178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118178"
},
{
"name": "CVE-2026-117989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117989"
},
{
"name": "CVE-2026-117890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117890"
},
{
"name": "CVE-2026-118010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118010"
},
{
"name": "CVE-2026-117873",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117873"
},
{
"name": "CVE-2026-118020",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118020"
},
{
"name": "CVE-2026-117862",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117862"
},
{
"name": "CVE-2026-117944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117944"
},
{
"name": "CVE-2026-117881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117881"
},
{
"name": "CVE-2026-118176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118176"
},
{
"name": "CVE-2026-117896",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117896"
},
{
"name": "CVE-2026-117994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117994"
},
{
"name": "CVE-2026-117968",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117968"
},
{
"name": "CVE-2026-117875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117875"
},
{
"name": "CVE-2026-113869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-113869"
},
{
"name": "CVE-2026-117876",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117876"
},
{
"name": "CVE-2026-117919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117919"
},
{
"name": "CVE-2026-117932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117932"
},
{
"name": "CVE-2026-117918",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117918"
},
{
"name": "CVE-2026-117940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117940"
},
{
"name": "CVE-2026-117993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117993"
},
{
"name": "CVE-2026-117955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117955"
},
{
"name": "CVE-2026-117887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117887"
},
{
"name": "CVE-2026-117903",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117903"
},
{
"name": "CVE-2026-118002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118002"
},
{
"name": "CVE-2026-117880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117880"
},
{
"name": "CVE-2026-118175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118175"
},
{
"name": "CVE-2026-117904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117904"
},
{
"name": "CVE-2026-118015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118015"
},
{
"name": "CVE-2026-117975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117975"
},
{
"name": "CVE-2026-117986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117986"
},
{
"name": "CVE-2026-117895",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117895"
},
{
"name": "CVE-2026-118180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118180"
},
{
"name": "CVE-2026-117958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117958"
},
{
"name": "CVE-2026-118003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118003"
},
{
"name": "CVE-2026-117917",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117917"
},
{
"name": "CVE-2026-117947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117947"
},
{
"name": "CVE-2026-117906",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117906"
},
{
"name": "CVE-2026-117936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117936"
},
{
"name": "CVE-2026-117995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117995"
},
{
"name": "CVE-2026-118023",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118023"
},
{
"name": "CVE-2026-117908",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117908"
},
{
"name": "CVE-2026-117916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117916"
},
{
"name": "CVE-2026-117961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117961"
},
{
"name": "CVE-2026-118000",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118000"
},
{
"name": "CVE-2026-117941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117941"
},
{
"name": "CVE-2026-118013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118013"
},
{
"name": "CVE-2026-117951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117951"
},
{
"name": "CVE-2026-117980",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117980"
},
{
"name": "CVE-2026-117930",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117930"
},
{
"name": "CVE-2026-117926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117926"
},
{
"name": "CVE-2026-117870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117870"
},
{
"name": "CVE-2026-117998",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117998"
},
{
"name": "CVE-2026-117877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117877"
},
{
"name": "CVE-2026-117949",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117949"
},
{
"name": "CVE-2026-117886",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117886"
},
{
"name": "CVE-2026-117902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117902"
},
{
"name": "CVE-2026-117905",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117905"
},
{
"name": "CVE-2026-117893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117893"
},
{
"name": "CVE-2026-118025",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118025"
},
{
"name": "CVE-2026-118021",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118021"
},
{
"name": "CVE-2026-117971",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-117971"
},
{
"name": "CVE-2026-118018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-118018"
}
],
"initial_release_date": "2026-10-28T00:00:00",
"last_revision_date": "2026-10-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1406",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-28T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Mozilla. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Mozilla",
"vendor_advisories": [
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-120",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-121",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-121/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-122",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-119",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-119/"
},
{
"published_at": "2026-10-27",
"title": "Bulletin de s\u00e9curit\u00e9 Mozilla mfsa2026-118",
"url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-118/"
}
]
}
CVE-2026-118180 (GCVE-0-2026-118180)
Vulnerability from cvelistv5
Published
2026-10-27 18:16
Modified
2026-10-27 18:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected: 153.6 Unaffected: 159 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Magnus Melin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server\u0027s login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user\u0027s NTLM credentials.\u003cbr /\u003eThe NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"value": "When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server\u0027s login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user\u0027s NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:27:53.280Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080939"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Matrix homeserver could redirect the chat session to a local file or network share"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118180",
"datePublished": "2026-10-27T18:16:33.495Z",
"dateReserved": "2026-10-27T18:16:33.089Z",
"dateUpdated": "2026-10-27T18:27:53.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118179 (GCVE-0-2026-118179)
Vulnerability from cvelistv5
Published
2026-10-27 18:16
Modified
2026-10-27 18:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected: 153.6 Unaffected: 159 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Tuan Hung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user\u0027s network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"value": "Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user\u0027s network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:27:52.176Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077789"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Request forgery via news: links"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118179",
"datePublished": "2026-10-27T18:16:32.658Z",
"dateReserved": "2026-10-27T18:16:32.317Z",
"dateUpdated": "2026-10-27T18:27:52.176Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118178 (GCVE-0-2026-118178)
Vulnerability from cvelistv5
Published
2026-10-27 18:16
Modified
2026-10-27 18:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected: 153.6 Unaffected: 159 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "KhalidAlharthi"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user\u0027s NTLM credentials.\u003cbr /\u003eThe NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"value": "A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user\u0027s NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:27:51.092Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075772"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "RSS feed could redirect its subscription to a local file or network share"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118178",
"datePublished": "2026-10-27T18:16:31.904Z",
"dateReserved": "2026-10-27T18:16:31.563Z",
"dateUpdated": "2026-10-27T18:27:51.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118177 (GCVE-0-2026-118177)
Vulnerability from cvelistv5
Published
2026-10-27 18:16
Modified
2026-10-27 18:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected: 153.6 Unaffected: 159 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Magnus Melin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user\u0027s NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker\u0027s share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"value": "When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user\u0027s NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker\u0027s share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:27:49.964Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080924"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Calendar discovery accepted local file and remote network share locations"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118177",
"datePublished": "2026-10-27T18:16:31.083Z",
"dateReserved": "2026-10-27T18:16:30.717Z",
"dateUpdated": "2026-10-27T18:27:49.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118176 (GCVE-0-2026-118176)
Vulnerability from cvelistv5
Published
2026-10-27 18:16
Modified
2026-10-27 18:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.
This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected: 153.6 Unaffected: 159 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "YuYoung Sung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Thunderbird\u0027s check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user\u0027s Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.\u003cbr /\u003eThis bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"value": "Thunderbird\u0027s check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user\u0027s Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.\nThis bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:27:48.875Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081141"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Bypass of remote UNC path restriction in mailbox: URLs"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118176",
"datePublished": "2026-10-27T18:16:30.272Z",
"dateReserved": "2026-10-27T18:16:29.898Z",
"dateUpdated": "2026-10-27T18:27:48.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118175 (GCVE-0-2026-118175)
Vulnerability from cvelistv5
Published
2026-10-27 18:16
Modified
2026-10-27 18:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected: 153.6 Unaffected: 159 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "YuYoung Sung"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"value": "When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:27:47.611Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081720"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Content of other messages could be included when replying to a crafted message"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118175",
"datePublished": "2026-10-27T18:16:29.537Z",
"dateReserved": "2026-10-27T18:16:29.111Z",
"dateUpdated": "2026-10-27T18:27:47.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118174 (GCVE-0-2026-118174)
Vulnerability from cvelistv5
Published
2026-10-27 18:16
Modified
2026-10-27 18:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Mozilla | Thunderbird |
Unaffected: 153.6 Unaffected: 159 |
{
"containers": {
"cna": {
"affected": [
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Magnus Melin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment\u0027s content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user\u0027s NTLM credentials.\u003cbr /\u003eThe NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"value": "When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment\u0027s content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user\u0027s NTLM credentials.\nThe NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:27:46.521Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2080910"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118174",
"datePublished": "2026-10-27T18:16:28.729Z",
"dateReserved": "2026-10-27T18:16:28.266Z",
"dateUpdated": "2026-10-27T18:27:46.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118026 (GCVE-0-2026-118026)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:37.886Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077075"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Invalid pointer in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118026",
"datePublished": "2026-10-27T14:06:05.943Z",
"dateReserved": "2026-10-27T14:06:05.746Z",
"dateUpdated": "2026-10-27T18:18:37.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118025 (GCVE-0-2026-118025)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:33.578Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082311"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Other issue in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118025",
"datePublished": "2026-10-27T14:06:05.536Z",
"dateReserved": "2026-10-27T14:06:05.334Z",
"dateUpdated": "2026-10-27T18:18:33.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118024 (GCVE-0-2026-118024)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:32.888Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081959"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Graphics: Text component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118024",
"datePublished": "2026-10-27T14:06:05.145Z",
"dateReserved": "2026-10-27T14:06:04.918Z",
"dateUpdated": "2026-10-27T18:18:32.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118023 (GCVE-0-2026-118023)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:26.392Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2079499"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Sandbox escape due to use-after-free in the Graphics: WebRender component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118023",
"datePublished": "2026-10-27T14:06:04.734Z",
"dateReserved": "2026-10-27T14:06:04.563Z",
"dateUpdated": "2026-10-27T18:18:26.392Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118022 (GCVE-0-2026-118022)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:21.367Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2078941"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Sandbox escape due to use-after-free in the Disability Access APIs component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118022",
"datePublished": "2026-10-27T14:06:04.383Z",
"dateReserved": "2026-10-27T14:06:04.213Z",
"dateUpdated": "2026-10-27T18:18:21.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118021 (GCVE-0-2026-118021)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:11.169Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076695"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Sandbox escape due to use-after-free in the XPCOM component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118021",
"datePublished": "2026-10-27T14:06:04.037Z",
"dateReserved": "2026-10-27T14:06:03.867Z",
"dateUpdated": "2026-10-27T18:18:11.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118020 (GCVE-0-2026-118020)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:18:06.754Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075977"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Layout component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118020",
"datePublished": "2026-10-27T14:06:03.687Z",
"dateReserved": "2026-10-27T14:06:03.527Z",
"dateUpdated": "2026-10-27T18:18:06.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118019 (GCVE-0-2026-118019)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:56.498Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2025386"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Race condition, use-after-free in the DOM: File component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118019",
"datePublished": "2026-10-27T14:06:03.344Z",
"dateReserved": "2026-10-27T14:06:03.150Z",
"dateUpdated": "2026-10-27T18:17:56.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118017 (GCVE-0-2026-118017)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:55.060Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082200"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the SVG component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118017",
"datePublished": "2026-10-27T14:06:02.550Z",
"dateReserved": "2026-10-27T14:06:02.382Z",
"dateUpdated": "2026-10-27T18:17:55.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118016 (GCVE-0-2026-118016)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:48.307Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082086"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118016",
"datePublished": "2026-10-27T14:06:02.197Z",
"dateReserved": "2026-10-27T14:06:02.018Z",
"dateUpdated": "2026-10-27T18:17:48.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118015 (GCVE-0-2026-118015)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the DOM: Core \u0026 HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:46.874Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082072"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the DOM: Core \u0026 HTML component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118015",
"datePublished": "2026-10-27T14:06:01.814Z",
"dateReserved": "2026-10-27T14:06:01.650Z",
"dateUpdated": "2026-10-27T18:17:46.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118014 (GCVE-0-2026-118014)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:44.493Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082051"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the JavaScript Engine: JIT component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118014",
"datePublished": "2026-10-27T14:06:01.470Z",
"dateReserved": "2026-10-27T14:06:01.298Z",
"dateUpdated": "2026-10-27T18:17:44.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118013 (GCVE-0-2026-118013)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:42.258Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2082040"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Layout: Images, Video, and HTML Frames component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118013",
"datePublished": "2026-10-27T14:06:01.113Z",
"dateReserved": "2026-10-27T14:06:00.944Z",
"dateUpdated": "2026-10-27T18:17:42.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118012 (GCVE-0-2026-118012)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:36.916Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081998"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the DOM: Animation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118012",
"datePublished": "2026-10-27T14:06:00.756Z",
"dateReserved": "2026-10-27T14:06:00.596Z",
"dateUpdated": "2026-10-27T18:17:36.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118011 (GCVE-0-2026-118011)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "OpenAI Codex Security (kylebot)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:17:36.146Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2081985"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Frame poisoning in the CSS Parsing and Computation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118011",
"datePublished": "2026-10-27T14:06:00.409Z",
"dateReserved": "2026-10-27T14:06:00.241Z",
"dateUpdated": "2026-10-27T18:17:36.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118010 (GCVE-0-2026-118010)
Vulnerability from cvelistv5
Published
2026-10-27 14:06
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:59.477Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077770"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the Disability Access APIs component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118010",
"datePublished": "2026-10-27T14:06:00.056Z",
"dateReserved": "2026-10-27T14:05:59.883Z",
"dateUpdated": "2026-10-27T18:16:59.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118009 (GCVE-0-2026-118009)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Nguyen Thanh Nguyen"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:52.906Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2076098"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Integer overflow, use-after-free in the Graphics: Text component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118009",
"datePublished": "2026-10-27T14:05:59.709Z",
"dateReserved": "2026-10-27T14:05:59.546Z",
"dateUpdated": "2026-10-27T18:16:52.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118008 (GCVE-0-2026-118008)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-28 03:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-118008",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T03:55:51.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Amy Burnett of OpenAI"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:51.508Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075440"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Privilege escalation in the DOM: Navigation component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118008",
"datePublished": "2026-10-27T14:05:59.374Z",
"dateReserved": "2026-10-27T14:05:59.210Z",
"dateUpdated": "2026-10-28T03:55:51.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118007 (GCVE-0-2026-118007)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:49.281Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2075296"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the JavaScript: GC component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118007",
"datePublished": "2026-10-27T14:05:59.029Z",
"dateReserved": "2026-10-27T14:05:58.863Z",
"dateUpdated": "2026-10-27T18:16:49.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118006 (GCVE-0-2026-118006)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:47.829Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2074202"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Privilege escalation due to use-after-free in the WebRTC: Signaling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118006",
"datePublished": "2026-10-27T14:05:58.678Z",
"dateReserved": "2026-10-27T14:05:58.516Z",
"dateUpdated": "2026-10-27T18:16:47.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118005 (GCVE-0-2026-118005)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"value": "Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:16:44.947Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2073653"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
}
],
"title": "Use-after-free in the WebRTC: Signaling component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118005",
"datePublished": "2026-10-27T14:05:58.322Z",
"dateReserved": "2026-10-27T14:05:58.162Z",
"dateUpdated": "2026-10-27T18:16:44.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118004 (GCVE-0-2026-118004)
Vulnerability from cvelistv5
Published
2026-10-27 14:05
Modified
2026-10-27 18:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Unaffected: 153.6 Unaffected: 159 |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThanOrEqual": "153.*",
"status": "unaffected",
"version": "153.6",
"versionType": "rpm"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "159",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Mozilla"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"value": "Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T18:30:31.194Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2077756"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-118/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-120/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-121/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2026-122/"
}
],
"title": "Incorrect boundary conditions in the CSS Transitions and Animations component"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2026-118004",
"datePublished": "2026-10-27T14:05:57.018Z",
"dateReserved": "2026-10-27T14:05:56.855Z",
"dateUpdated": "2026-10-27T18:30:31.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}