CVEsMozillaCVE-2026-117938Published Oct 27, 14:05 · Updated Oct 27, 18:29 UTC
–
Not scored
CVE-2026-117938

Use-after-free in the Layout component

Firefox
AffectedFirefox, Thunderbird
FixUpdate to 115.44, 153.6, 159 or newer
PublishedOct 27, 14:05 · mozilla
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC

What we know

No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.

Description

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

From mozilla

Affected and fixed versions

ProductAffectedFixed inFirefoxNot affected115.44FirefoxNot affected153.6FirefoxNot affected159ThunderbirdNot affected153.6ThunderbirdNot affected159

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

bugzilla.mozilla.org/show_bug.cgi?id=2082009 · bugzilla.mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-118/ · mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-119/ · mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-120/ · mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-121/ · mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-122/ · mozilla.org

Other CVEs in Firefox

All 1,852 →
–Frame poisoning in the Layout component · CVE-2026-118027Oct 27–Invalid pointer in the JavaScript: GC component · CVE-2026-118026Oct 27–Other issue in the SVG component · CVE-2026-118025Oct 27