{"id":"CVE-2026-117917","kind":"vulnerability","aliases":["CVE-2026-117917"],"related":[],"title":"Firefox: invalid pointer in WebRender graphics can crash or be exploited","description":"Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Firefox's WebRender graphics component dereferences an invalid pointer, a memory-safety flaw. The sources do not say what an attacker can achieve beyond that, and the fix ships in Firefox 159 and ESR 115.44 and 153.6.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browsers","desktop","firefox","package"],"not_affected_if":["already-updated-browser"],"how_to_check":"- Run `firefox --version` (or check About Firefox) and compare with `159`, `115.44` or `153.6` for ESR\n- Confirm the installed ESR branch matches the fixed release line","fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`","status":"open","published_at":"2026-10-27T14:16:47+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:22+00:00","updated_at":"2026-10-27T14:37:22+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-27T14:37:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `115.44` or `153.6`","reach":"unknown","title":"Firefox: invalid pointer in WebRender graphics can crash or be exploited","impact":"high","summary":"Firefox's WebRender graphics component dereferences an invalid pointer, a memory-safety flaw. The sources do not say what an attacker can achieve beyond that, and the fix ships in Firefox 159 and ESR 115.44 and 153.6.","category":"package","nicknames":[],"who_cares":["firefox","browsers","desktop"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; memory corruption could allow code execution","analyst_note":"Check the Mozilla security advisory for this CVE for exploitation conditions and whether code execution is demonstrated.","how_to_check":"- Run `firefox --version` (or check About Firefox) and compare with `159`, `115.44` or `153.6` for ESR\n- Confirm the installed ESR branch matches the fixed release line","needs_analyst":true,"not_affected_if":["already-updated-browser"],"who_is_affected":"Anyone running Firefox builds older than the fixed releases on desktop or managed browser fleets. The sources do not say whether the flaw needs a specific page, setting or platform, so unknown whether some configurations are safe.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000585,"input_tokens":3254,"output_tokens":520,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117917':14A,17A '-2026':13A,16A '115.44':57B,76C '153.6':59B,80C '159':54B,73C 'achiev':45B 'attack':43B 'beyond':46B 'browser':18B 'compon':26B,66C 'crash':8A 'cve':12A,15A 'derefer':27B 'desktop':19B 'esr':56B,75C,79C 'exploit':11A 'firefox':1A,20B,22B,53B,72C,74C,78C 'fix':50B,70C 'flaw':35B 'graphic':6A,25B,64C 'invalid':2A,29B,60C 'memori':33B 'memory-safeti':32B 'packag':21B 'pointer':3A,30B,61C 'safeti':34B 'say':40B 'ship':51B 'sourc':37B 'vulner':68C 'webrend':5A,24B,65C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than the fixed releases on desktop or managed browser fleets. The sources do not say whether the flaw needs a specific page, setting or platform, so unknown whether some configurations are safe.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117917","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117917","severity":null,"published_at":"2026-10-27T14:16:47+00:00","modified_at":"2026-10-27T14:16:47+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}