Live › vulnerability › CVE-2026-113401
Go to dashboardA flaw in the PDF Viewer component of Firefox and Thunderbird allows a denial of service, meaning a crafted PDF can make the application hang or crash. The sources say the issue was fixed in Firefox 158.0.1 and Thunderbird 158.0.1, and do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Firefox or Thunderbird builds older than 158.0.1 can be affected, most directly where PDFs are opened in the built-in viewer, including PDF attachments previewed in Thunderbird. Managed fleets that pin browser or mail client versions should confirm the update reached all machines. Systems that do not use these applications can skip it.
No product ranges from the sources yet.
firefox --version on Linuxthunderbird --version on Linux158.0.1 or later158.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-113401")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.