{"id":"CVE-2026-117877","kind":"vulnerability","aliases":["CVE-2026-117877"],"related":[],"title":"Firefox: use-after-free in text layout lets attacker run code","description":"Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A use-after-free flaw in Firefox's Layout: Text and Fonts component lets memory be reused after it is freed. The sources do not say what an attacker can do beyond that, but memory corruption of this kind in a browser is commonly exploited to run code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","firefox-esr","other"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Run `firefox --version` (or check Help > About Firefox) and compare against the fixed versions.\n- Check the Firefox ESR line with the same command on ESR installs.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","status":"open","published_at":"2026-10-27T14:16:43+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","triaged_at":"2026-10-27T14:39:06+00:00","updated_at":"2026-10-27T14:39:06+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:39:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `153.6` or later.","reach":"unknown","title":"Firefox: use-after-free in text layout lets attacker run code","impact":"high","summary":"A use-after-free flaw in Firefox's Layout: Text and Fonts component lets memory be reused after it is freed. The sources do not say what an attacker can do beyond that, but memory corruption of this kind in a browser is commonly exploited to run code.","category":"other","nicknames":[],"who_cares":["firefox","firefox-esr","desktop","browsers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser could allow code execution","analyst_note":"Check Mozilla's Firefox 159 security advisory for the trigger path, whether it is exploited, and the CVSS score; NVD entry gives none.","how_to_check":"- Run `firefox --version` (or check Help > About Firefox) and compare against the fixed versions.\n- Check the Firefox ESR line with the same command on ESR installs.","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions, including managed desktop fleets that pin browser builds. The sources do not say whether any specific configuration or page type is needed to trigger it, so unknown for the trigger path.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000594,"input_tokens":3244,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117877':15A,18A '-2026':14A,17A '153.6':95C '159':91C 'attack':10A,54B 'beyond':57B 'browser':19B,67B 'code':12A,73B 'common':69B 'compon':38B,84C 'corrupt':61B 'cve':13A,16A 'desktop':20B 'esr':24B,94C 'exploit':70B 'firefox':1A,21B,23B,32B,90C,93C 'firefox-esr':22B 'fix':88C 'flaw':30B 'font':37B,83C 'free':5A,29B,77C 'freed':46B 'kind':64B 'layout':8A,34B,80C 'let':9A,39B 'memori':40B,60B 'reus':42B 'run':11A,72B 'say':51B 'sourc':48B 'text':7A,35B,81C 'use':3A,27B,75C 'use-after-fre':2A,26B,74C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or Firefox ESR older than the fixed versions, including managed desktop fleets that pin browser builds. The sources do not say whether any specific configuration or page type is needed to trigger it, so unknown for the trigger path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117877","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117877","severity":null,"published_at":"2026-10-27T14:16:43+00:00","modified_at":"2026-10-27T14:16:43+00:00","first_seen_at":"2026-10-27T14:32:21+00:00","fetched_at":"2026-10-27T14:32:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}