Live › vulnerability › CVE-2026-117914
Go to dashboardA use-after-free bug in Firefox's SVG component can corrupt memory when a page is rendered. The sources do not say what an attacker gets beyond that, so the impact is unconfirmed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams that ship or run Firefox on managed desktops, or that depend on a bundled Firefox or ESR build, are the ones to check. Systems on other browsers or on Firefox builds newer than the fixed releases are not affected by this entry. The sources do not describe the conditions needed to trigger the flaw.
No product ranges from the sources yet.
firefox --version159, Firefox ESR 115.44, Firefox ESR 153.6159 or later on the current channel115.44 or 153.6 on the ESR channelsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117914")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.