–
Not scored
CVE-2026-118024
Use-after-free in the Graphics: Text component
FirefoxAffectedFirefox, Thunderbird
FixUpdate to 159 or newer
PublishedOct 27, 14:06 · mozilla
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
From mozilla
Affected and fixed versions
ProductAffectedFixed inFirefoxNot affected159ThunderbirdNot affected159
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known