{"id":"CVE-2026-117897","kind":"vulnerability","aliases":["CVE-2026-117897"],"related":[],"title":"Firefox: incorrect boundary handling in table layout code, fixed in 159","description":"Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Firefox's Layout: Tables component mishandles boundary conditions, which the sources do not describe further. The flaw was fixed in Firefox 159 and Firefox ESR 115.44 and 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["fixed-version-installed"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159`, `115.44` for ESR 115, or `153.6` for ESR 153\n- Check the Firefox version on managed fleets through your MDM or policy tooling","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, depending on the ESR branch in use","status":"open","published_at":"2026-10-27T14:16:45+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:42+00:00","updated_at":"2026-10-27T14:37:42+00:00","category":"runtime","confidence":0.3,"triage":{"at":"2026-10-27T14:37:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`, depending on the ESR branch in use","reach":"internet","title":"Firefox: incorrect boundary handling in table layout code, fixed in 159","impact":"high","summary":"Firefox's Layout: Tables component mishandles boundary conditions, which the sources do not describe further. The flaw was fixed in Firefox 159 and Firefox ESR 115.44 and 153.6.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.3,"needs_auth":"no","worst_case":"unknown; sources do not state the impact","analyst_note":"Check the Mozilla security advisory for CVE-2026-117897 to confirm the impact type, whether it is exploitable from web content, and whether it is in the wild.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare against `159`, `115.44` for ESR 115, or `153.6` for ESR 153\n- Check the Firefox version on managed fleets through your MDM or policy tooling","needs_analyst":true,"not_affected_if":["fixed-version-installed"],"who_is_affected":"Anyone running a Firefox build older than the fixed versions on a desktop or managed endpoint. The sources do not say what page content or setting triggers the flaw, so whether a given browsing pattern is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000597,"input_tokens":3258,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117897':14A,17A '-2026':13A,16A '115.44':47B,67C '153.6':49B,71C '159':11A,43B,64C 'boundari':3A,28B,51C 'browser':18B 'code':8A 'compon':26B,57C 'condit':29B,52C 'cve':12A,15A 'describ':35B 'desktop':19B 'esr':46B,66C,70C 'firefox':1A,20B,22B,42B,45B,63C,65C,69C 'fix':9A,40B,61C 'flaw':38B 'handl':4A 'incorrect':2A,50C 'layout':7A,24B,55C 'mishandl':27B 'runtim':21B 'sourc':32B 'tabl':6A,25B,56C 'vulner':59C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Firefox build older than the fixed versions on a desktop or managed endpoint. The sources do not say what page content or setting triggers the flaw, so whether a given browsing pattern is exposed is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117897","severity":null,"published_at":"2026-10-27T14:16:45+00:00","modified_at":"2026-10-27T14:16:45+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}