---
id: "CVE-2026-113399"
kind: "vulnerability"
aliases: ["CVE-2026-113399"]
title: "Firefox and Thunderbird: SVG boundary check flaw fixed in 158.0.1"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["desktop", "firefox", "other", "thunderbird"]
not_affected_if: []
published_at: "2026-10-20T13:16:40+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T05:04:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113399", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Firefox and Thunderbird: SVG boundary check flaw fixed in 158.0.1

An incorrect boundary condition in Firefox and Thunderbird's SVG component was fixed in version 158.0.1. The sources do not say what an attacker can gain from it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Firefox version with `firefox --version` or the About Firefox page.
- Check the installed Thunderbird version with `thunderbird --version` or the About Thunderbird page.

## Fix

- Update Firefox to `158.0.1` or later.
- Update Thunderbird to `158.0.1` or later.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113399

## From the sources

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_