{"id":"CVE-2026-117914","kind":"vulnerability","aliases":["CVE-2026-117914"],"related":[],"title":"Firefox: use-after-free in the SVG component, fixed in releases","description":"Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in Firefox's SVG component can corrupt memory when a page is rendered. The sources do not say what an attacker gets beyond that, so the impact is unconfirmed.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","runtime"],"not_affected_if":["other-browser"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Compare against the fixed releases: Firefox `159`, Firefox ESR `115.44`, Firefox ESR `153.6`","fix":"- Update Firefox to `159` or later on the current channel\n- Update Firefox ESR to `115.44` or `153.6` on the ESR channels","status":"open","published_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:24+00:00","updated_at":"2026-10-27T14:37:24+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-27T14:37:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later on the current channel\n- Update Firefox ESR to `115.44` or `153.6` on the ESR channels","reach":"unknown","title":"Firefox: use-after-free in the SVG component, fixed in releases","impact":"medium","summary":"A use-after-free bug in Firefox's SVG component can corrupt memory when a page is rendered. The sources do not say what an attacker gets beyond that, so the impact is unconfirmed.","category":"runtime","nicknames":[],"who_cares":["firefox","browser","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption in the browser, exploit details not stated","analyst_note":"Check the Mozilla security advisory for the impact and whether it is exploitable from a web page, using the NVD link in the sources.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`\n- Compare against the fixed releases: Firefox `159`, Firefox ESR `115.44`, Firefox ESR `153.6`","needs_analyst":true,"not_affected_if":["other-browser"],"who_is_affected":"Teams that ship or run Firefox on managed desktops, or that depend on a bundled Firefox or ESR build, are the ones to check. Systems on other browsers or on Firefox builds newer than the fixed releases are not affected by this entry. The sources do not describe the conditions needed to trigger the flaw.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3240,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117914':15A,18A '-2026':14A,17A '115.44':75C '153.6':79C '159':72C 'attack':49B 'beyond':51B 'browser':19B 'bug':28B 'compon':9A,33B,65C 'corrupt':35B 'cve':13A,16A 'desktop':20B 'esr':74C,78C 'firefox':1A,21B,30B,71C,73C,77C 'fix':10A,69C 'free':5A,27B,61C 'get':50B 'impact':55B 'memori':36B 'page':39B 'releas':12A 'render':41B 'runtim':22B 'say':46B 'sourc':43B 'svg':8A,32B,64C 'unconfirm':57B 'use':3A,25B,59C 'use-after-fre':2A,24B,58C 'vulner':67C","nicknames":[],"mitigations":[],"who_affected":"Teams that ship or run Firefox on managed desktops, or that depend on a bundled Firefox or ESR build, are the ones to check. Systems on other browsers or on Firefox builds newer than the fixed releases are not affected by this entry. The sources do not describe the conditions needed to trigger the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117914","severity":null,"published_at":"2026-10-27T14:16:46+00:00","modified_at":"2026-10-27T14:16:46+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}