Live › vulnerability › CVE-2026-117926
Go to dashboardFirefox's SVG rendering code has incorrect boundary conditions, a memory-safety class of flaw. The sources do not say what an attacker can achieve beyond that, so the exact impact is unknown.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox on a version older than the fixed releases is potentially exposed, since the flaw is in the browser's SVG handling that runs when a page or image is rendered. Teams that only run managed Firefox builds pushed by IT can confirm the version centrally. The sources do not say whether the flaw is reachable without user interaction.
No product ranges from the sources yet.
firefox --version; releases before 159, 115.44 ESR, or 153.6 ESR are in scope.159 or to ESR 115.44 or 153.6.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117926")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.