CVE-2026-109773
6.5MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
6.5Medium
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Attackers can trigger a denial-of-service crash via the Sync component. This requires remote network interaction and user interaction.
Root cause
An uncontrolled resource consumption issue (CWE-400) exists within the Sync component.
Affected systems
Firefox versions prior to 158 and Thunderbird versions prior to 158.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to Firefox 158 and Thunderbird 158 or later. No interim mitigation is documented in the advisory.
shell
$ sudo apt-get update && sudo apt-get install --only-upgrade firefox thunderbirdAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
Ad · In-content banner
NVD description
Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.