CVEsMozillaCVE-2026-118025Published Oct 27, 14:06 · Updated Oct 27, 18:18 UTC
–
Not scored
CVE-2026-118025

Other issue in the SVG component

Firefox
AffectedFirefox, Thunderbird
FixUpdate to 159 or newer
PublishedOct 27, 14:06 · mozilla
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC

What we know

No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.

Description

Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

From mozilla

Affected and fixed versions

ProductAffectedFixed inFirefoxNot affected159ThunderbirdNot affected159

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

bugzilla.mozilla.org/show_bug.cgi?id=2082311 · bugzilla.mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-118/ · mozilla.orgwww.mozilla.org/security/advisories/mfsa2026-121/ · mozilla.org

Other CVEs in Firefox

All 1,852 →
–Frame poisoning in the Layout component · CVE-2026-118027Oct 27–Invalid pointer in the JavaScript: GC component · CVE-2026-118026Oct 27–Use-after-free in the Graphics: Text component · CVE-2026-118024Oct 27