{"id":"CVE-2026-113401","kind":"vulnerability","aliases":["CVE-2026-113401"],"related":[],"title":"Firefox and Thunderbird: PDF Viewer flaw lets a file crash the app","description":"Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.","summary":"A flaw in the PDF Viewer component of Firefox and Thunderbird allows a denial of service, meaning a crafted PDF can make the application hang or crash. The sources say the issue was fixed in Firefox 158.0.1 and Thunderbird 158.0.1, and do not describe code execution.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","endpoints","firefox","other","thunderbird"],"not_affected_if":["default-config-no-pdf-viewing"],"how_to_check":"- Check the installed Firefox version via Help > About Firefox, or `firefox --version` on Linux\n- Check the installed Thunderbird version via Help > About Thunderbird, or `thunderbird --version` on Linux","fix":"- Update Firefox to `158.0.1` or later\n- Update Thunderbird to `158.0.1` or later","status":"open","published_at":"2026-10-20T13:16:41+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:55:38+00:00","updated_at":"2026-10-25T03:55:38+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:55:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `158.0.1` or later\n- Update Thunderbird to `158.0.1` or later","reach":"internet","title":"Firefox and Thunderbird: PDF Viewer flaw lets a file crash the app","impact":"low","summary":"A flaw in the PDF Viewer component of Firefox and Thunderbird allows a denial of service, meaning a crafted PDF can make the application hang or crash. The sources say the issue was fixed in Firefox 158.0.1 and Thunderbird 158.0.1, and do not describe code execution.","category":"other","nicknames":[],"who_cares":["firefox","thunderbird","desktop","endpoints"],"confidence":0.6,"needs_auth":"no","worst_case":"Browser or mail client crashes or hangs when a crafted PDF is opened","analyst_note":"Sources give only the fixed versions and a one-line description; check the NVD entry or Mozilla's advisory for the exact affected range and whether the flaw is limited to denial of service.","how_to_check":"- Check the installed Firefox version via Help > About Firefox, or `firefox --version` on Linux\n- Check the installed Thunderbird version via Help > About Thunderbird, or `thunderbird --version` on Linux","needs_analyst":true,"not_affected_if":["default-config-no-pdf-viewing"],"who_is_affected":"Anyone running Firefox or Thunderbird builds older than 158.0.1 can be affected, most directly where PDFs are opened in the built-in viewer, including PDF attachments previewed in Thunderbird. Managed fleets that pin browser or mail client versions should confirm the update reached all machines. Systems that do not use these applications can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00064,"input_tokens":3251,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113401':15A,18A '-2026':14A,17A '158.0.1':60B,63B,85C,88C 'allow':35B 'app':12A 'applic':47B 'code':68B 'compon':30B,78C 'craft':42B 'crash':10A,50B 'cve':13A,16A 'denial':37B,71C 'denial-of-servic':70C 'describ':67B 'desktop':19B 'endpoint':20B 'execut':69B 'file':9A 'firefox':1A,21B,32B,59B,84C 'fix':57B,82C 'flaw':6A,25B 'hang':48B 'issu':55B 'let':7A 'make':45B 'mean':40B 'pdf':4A,28B,43B,76C 'say':53B 'servic':39B,73C 'sourc':52B 'thunderbird':3A,23B,34B,62B,87C 'viewer':5A,29B,77C 'vulner':80C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Thunderbird builds older than 158.0.1 can be affected, most directly where PDFs are opened in the built-in viewer, including PDF attachments previewed in Thunderbird. Managed fleets that pin browser or mail client versions should confirm the update reached all machines. Systems that do not use these applications can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:16:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113401","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113401","severity":null,"published_at":"2026-10-20T13:16:41+00:00","modified_at":"2026-10-20T20:17:17+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}