Live › vulnerability › CVE-2026-117908
Go to dashboardA use-after-free bug in Firefox's Graphics ImageLib component can corrupt memory when a crafted image is processed. The sources do not say what an attacker gains beyond that, so the exact impact is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running a Firefox build older than the fixed versions is exposed, since the flaw is in the browser's image handling, which runs when a page or file is rendered. Teams that only run managed, auto-updated desktops with current Firefox or ESR builds can confirm they are already patched. The sources do not say which earlier versions are affected.
No product ranges from the sources yet.
firefox --version (or check Help > About) and compare against 159 and ESR 115.44 and 153.6159 or later115.44 or 153.6Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117908")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.