{"id":"CVE-2026-117923","kind":"vulnerability","aliases":["CVE-2026-117923"],"related":[],"title":"Firefox: use-after-free in Audio/Video component can be triggered by page content","description":"Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"A use-after-free bug in Firefox's Audio/Video component can corrupt memory when handling media. The sources do not say what an attacker can run once the memory is corrupted.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","firefox-esr","runtime"],"not_affected_if":["already-patched"],"how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`, and compare it to the fixed releases.\n- Check ESR installs with `firefox --version` against `115.44` and `153.6`.","fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `115.44` or later on the 115 branch, or `153.6` or later on the 153 branch.","status":"open","published_at":"2026-10-27T14:16:47+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","triaged_at":"2026-10-27T14:37:15+00:00","updated_at":"2026-10-27T14:37:15+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-27T14:37:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- Update Firefox ESR to `115.44` or later on the 115 branch, or `153.6` or later on the 153 branch.","reach":"internet","title":"Firefox: use-after-free in Audio/Video component can be triggered by page content","impact":"high","summary":"A use-after-free bug in Firefox's Audio/Video component can corrupt memory when handling media. The sources do not say what an attacker can run once the memory is corrupted.","category":"runtime","nicknames":[],"who_cares":["firefox","desktop-browsers","firefox-esr"],"confidence":0.5,"needs_auth":"no","worst_case":"unknown; memory corruption in the browser, exploitability not stated by the sources","analyst_note":"Check the Mozilla security advisory for CVE-2026-117923 to confirm the trigger, whether exploitation is known, and the severity rating.","how_to_check":"- Check the installed Firefox version in the browser's About page or with `firefox --version`, and compare it to the fixed releases.\n- Check ESR installs with `firefox --version` against `115.44` and `153.6`.","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Any installation of Firefox or Firefox ESR older than the fixed versions is in scope, since the flaw is in the browser's own media code and is reached through web content. The sources do not say which media formats or configurations trigger it. Systems already on the fixed releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000603,"input_tokens":3246,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117923':17A,20A '-2026':16A,19A '115.44':78C '153.6':82C '159':75C 'attack':53B 'audio/video':7A,38B,67C 'browser':23B 'bug':34B 'compon':8A,39B,68C 'content':14A 'corrupt':41B,60B 'cve':15A,18A 'desktop':22B 'desktop-brows':21B 'esr':27B,77C,81C 'firefox':1A,24B,26B,36B,74C,76C,80C 'firefox-esr':25B 'fix':72C 'free':5A,33B,64C 'handl':44B 'media':45B 'memori':42B,58B 'page':13A 'run':55B 'runtim':28B 'say':50B 'sourc':47B 'trigger':11A 'use':3A,31B,62C 'use-after-fre':2A,30B,61C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Any installation of Firefox or Firefox ESR older than the fixed versions is in scope, since the flaw is in the browser's own media code and is reached through web content. The sources do not say which media formats or configurations trigger it. Systems already on the fixed releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117923","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117923","severity":null,"published_at":"2026-10-27T14:16:47+00:00","modified_at":"2026-10-27T14:16:47+00:00","first_seen_at":"2026-10-27T14:32:22+00:00","fetched_at":"2026-10-27T14:32:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}