CVEvulnerability
CVE-2026-109712
7.1 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-10-13
- Last modified
- 2026-10-16
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
- Weaknesses
- CWE-908
Description
Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
Related
Weakness · CWE (1)
- CWE-908 Use of Uninitialized Resource weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2068420 bugzilla.mozilla.org
- https://www.mozilla.org/security/advisories/mfsa2026-106/ www.mozilla.org
- https://www.mozilla.org/security/advisories/mfsa2026-107/ www.mozilla.org
- https://www.mozilla.org/security/advisories/mfsa2026-108/ www.mozilla.org
- https://www.mozilla.org/security/advisories/mfsa2026-109/ www.mozilla.org
- https://www.mozilla.org/security/advisories/mfsa2026-110/ www.mozilla.org