Live › vulnerability › CVE-2026-117874
Go to dashboardA use-after-free bug in the Internationalization component of Firefox lets memory be reused after it is freed. The sources do not say what an attacker can achieve with it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running an affected Firefox release on desktop or Android is exposed; the sources do not describe the exact trigger. Systems that run only a managed or already-updated Firefox build should confirm the version in their fleet. The sources do not say who can skip it.
No product ranges from the sources yet.
firefox --version, and compare it with the fixed releases 159, 115.44 ESR and 153.6 ESR.159 or later on the regular channel.115.44 or 153.6 (or later) on the ESR channel.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117874")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.