CVE-2026-109716

8.1High

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: High impact on confidentiality, integrity
Weakness: CWE-119

Impact

Remote attackers can compromise confidentiality and integrity if a user visits a malicious page or views a crafted email. The attack requires no privileges but depends on user interaction.

Root cause

Incorrect boundary condition checking in the JavaScript engine leads to memory corruption.

Affected systems

Firefox versions prior to 158, Firefox ESR prior to 115.43 and 153.5, and Thunderbird prior to 158 and 153.5.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Fix & remediation

Upgrade to Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim mitigation is listed; patch the software immediately.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbird

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109716