CVE-2026-109726
5.4MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-416
Impact
Remote attackers can potentially compromise browser memory to disclose data or modify application state if a user views malicious SVG content. Exploitation requires user interaction to open or render a crafted SVG page or email.
Root cause
A use-after-free vulnerability exists in the SVG rendering component.
Affected systems
Firefox prior to 158, Firefox ESR prior to 115.43, Firefox ESR prior to 153.5, Thunderbird prior to 158, and Thunderbird prior to 153.5.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade to Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, or Thunderbird 153.5. No interim mitigation is documented; patching is required.
$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbirdAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2074212
- https://www.mozilla.org/security/advisories/mfsa2026-106/
- https://www.mozilla.org/security/advisories/mfsa2026-107/
- https://www.mozilla.org/security/advisories/mfsa2026-108/
- https://www.mozilla.org/security/advisories/mfsa2026-109/
- https://www.mozilla.org/security/advisories/mfsa2026-110/