{"id":"CVE-2026-117907","kind":"vulnerability","aliases":["CVE-2026-117907"],"related":[],"title":"Firefox: use-after-free in Networking component fixed in 159","description":"Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in the Networking component of Firefox could let a crafted condition corrupt memory. The sources do not say what an attacker gets beyond that, such as code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","esr","firefox","runtime"],"not_affected_if":[],"how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`\n- Unknown whether a non-browser Firefox build or ESR channel is in use beyond the versions listed","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR 115 to `115.44` or later\n- Update Firefox ESR 153 to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:31+00:00","updated_at":"2026-10-27T14:37:31+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:37:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR 115 to `115.44` or later\n- Update Firefox ESR 153 to `153.6` or later","reach":"unknown","title":"Firefox: use-after-free in Networking component fixed in 159","impact":"high","summary":"A use-after-free bug in the Networking component of Firefox could let a crafted condition corrupt memory. The sources do not say what an attacker gets beyond that, such as code execution.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop-browsers","esr"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser networking code","analyst_note":"Check Mozilla's Firefox 159 release notes and the Mozilla security advisory for this CVE to confirm the trigger, impact and whether it is remotely reachable.","how_to_check":"- Check the Firefox version in the browser's About page or with `firefox --version`\n- Unknown whether a non-browser Firefox build or ESR channel is in use beyond the versions listed","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone running Firefox builds older than the fixed versions, including desktop users and organizations on ESR channels. The sources do not say which configurations or features trigger the flaw, so unknown whether a default install is exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3240,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117907':14A,17A '-2026':13A,16A '115.44':75C '153.6':79C '159':11A,72C 'attack':50B 'beyond':52B 'browser':20B 'bug':29B 'code':56B 'compon':8A,33B,65C 'condit':40B 'corrupt':41B 'could':36B 'craft':39B 'cve':12A,15A 'desktop':19B 'desktop-brows':18B 'esr':21B,74C,78C 'execut':57B 'firefox':1A,22B,35B,71C,73C,77C 'fix':9A,69C 'free':5A,28B,61C 'get':51B 'let':37B 'memori':42B 'network':7A,32B,64C 'runtim':23B 'say':47B 'sourc':44B 'use':3A,26B,59C 'use-after-fre':2A,25B,58C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than the fixed versions, including desktop users and organizations on ESR channels. The sources do not say which configurations or features trigger the flaw, so unknown whether a default install is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117907","severity":null,"published_at":"2026-10-27T14:16:46+00:00","modified_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}