{"id":"CVE-2026-117894","kind":"vulnerability","aliases":["CVE-2026-117894"],"related":[],"title":"Firefox: WebRTC signaling boundary error fixed in Firefox 159","description":"Incorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"Firefox's WebRTC signaling component mishandles boundary conditions, a memory-safety style flaw. The sources do not say what an attacker can gain from it beyond that it was fixed in Firefox 159 and Firefox ESR 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","firefox","runtime","webrtc"],"not_affected_if":["firefox-already-updated"],"how_to_check":"- Run `Firefox --version` or open the about:support page and compare against `159` or `153.6` for ESR builds\n- Check the Firefox version on managed fleets with your endpoint management tool","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:45+00:00","updated_at":"2026-10-27T14:37:45+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:37:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: WebRTC signaling boundary error fixed in Firefox 159","impact":"medium","summary":"Firefox's WebRTC signaling component mishandles boundary conditions, a memory-safety style flaw. The sources do not say what an attacker can gain from it beyond that it was fixed in Firefox 159 and Firefox ESR 153.6.","category":"runtime","nicknames":[],"who_cares":["firefox","browsers","webrtc"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; the sources do not state the impact","analyst_note":"Check the Mozilla Foundation security advisory for Firefox 159 and ESR 153.6 to learn the impact, trigger conditions and whether it is remotely reachable.","how_to_check":"- Run `Firefox --version` or open the about:support page and compare against `159` or `153.6` for ESR builds\n- Check the Firefox version on managed fleets with your endpoint management tool","needs_analyst":true,"not_affected_if":["firefox-already-updated"],"who_is_affected":"unknown. The sources name only the affected component (WebRTC signaling) and the fixed releases, not the trigger, the required content, or the platforms. Any team with Firefox or Firefox ESR clients in use should update, since the fix ships to the browser itself.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000599,"input_tokens":3252,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117894':12A,15A '-2026':11A,14A '153.6':57B,76C '159':9A,53B,72C 'attack':41B 'beyond':46B 'boundari':4A,26B,59C 'browser':16B 'compon':24B,65C 'condit':27B,60C 'cve':10A,13A 'error':5A 'esr':56B,75C 'firefox':1A,8A,17B,20B,52B,55B,71C,74C 'fix':6A,50B,69C 'flaw':33B 'gain':43B 'incorrect':58C 'memori':30B 'memory-safeti':29B 'mishandl':25B 'runtim':18B 'safeti':31B 'say':38B 'signal':3A,23B,64C 'sourc':35B 'style':32B 'vulner':67C 'webrtc':2A,19B,22B,63C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117894","severity":null,"published_at":"2026-10-27T14:16:44+00:00","modified_at":"2026-10-27T14:16:44+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}