{"id":"CVE-2026-117893","kind":"vulnerability","aliases":["CVE-2026-117893"],"related":[],"title":"Firefox: boundary check flaw in the PSM security component","description":"Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Mozilla's Firefox has an incorrect boundary condition in its Security: PSM component, which handles TLS and certificate code. The sources do not say what an attacker gets from it, beyond that it was fixed in Firefox 159 and Firefox ESR 115.44 and 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","firefox","firefox-esr","other"],"not_affected_if":["already-updated"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or the ESR builds `115.44` and `153.6`\n- Check the ESR line in use, for example with `firefox --version` on managed installs","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, whichever matches the ESR line in use","status":"open","published_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:46+00:00","updated_at":"2026-10-27T14:37:46+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:37:46Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, whichever matches the ESR line in use","reach":"unknown","title":"Firefox: boundary check flaw in the PSM security component","impact":"medium","summary":"Mozilla's Firefox has an incorrect boundary condition in its Security: PSM component, which handles TLS and certificate code. The sources do not say what an attacker gets from it, beyond that it was fixed in Firefox 159 and Firefox ESR 115.44 and 153.6.","category":"other","nicknames":[],"who_cares":["firefox","firefox-esr","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact","analyst_note":"Read the Mozilla advisory for CVE-2026-117893 to learn the actual impact, trigger and whether it is exploitable from web content.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159` or the ESR builds `115.44` and `153.6`\n- Check the ESR line in use, for example with `firefox --version` on managed installs","needs_analyst":true,"not_affected_if":["already-updated"],"who_is_affected":"Anyone running Firefox or a Firefox ESR build older than the fixed versions is in scope, since PSM is part of the browser itself rather than a server component. The sources do not say which configurations or content are needed to trigger it. Systems that only run a patched version or a managed browser that auto-updates can skip the manual step.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000617,"input_tokens":3256,"output_tokens":582,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117893':12A,15A '-2026':11A,14A '115.44':62B,82C '153.6':64B,86C '159':58B,79C 'attack':47B 'beyond':51B 'boundari':2A,27B,66C 'certif':38B 'check':3A 'code':39B 'compon':9A,33B,72C 'condit':28B,67C 'cve':10A,13A 'desktop':16B 'esr':20B,61B,81C,85C 'firefox':1A,17B,19B,23B,57B,60B,78C,80C,84C 'firefox-esr':18B 'fix':55B,76C 'flaw':4A 'get':48B 'handl':35B 'incorrect':26B,65C 'mozilla':21B 'psm':7A,32B,71C 'say':44B 'secur':8A,31B,70C 'sourc':41B 'tls':36B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox or a Firefox ESR build older than the fixed versions is in scope, since PSM is part of the browser itself rather than a server component. The sources do not say which configurations or content are needed to trigger it. Systems that only run a patched version or a managed browser that auto-updates can skip the manual step.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117893","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117893","severity":null,"published_at":"2026-10-27T14:16:44+00:00","modified_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}