{"id":"CVE-2026-117939","kind":"vulnerability","aliases":["CVE-2026-117939"],"related":[],"title":"Firefox: use-after-free in XML component fixed in version 159","description":"Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.","summary":"Firefox has a use-after-free bug in its XML component, where memory is used after it has been released. The sources do not say what an attacker can do with it beyond that memory-safety flaw.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["browser","desktop","firefox","other"],"not_affected_if":["already-patched"],"how_to_check":"- Check the installed Firefox version against the fixed releases: `159`, ESR `115.44`, and ESR `153.6`.\n- unknown","fix":"- Update Firefox to `159` or later.\n- If on the ESR channel, update to `115.44` (ESR 115 line) or `153.6` (ESR 153 line).","status":"open","published_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:37:01+00:00","updated_at":"2026-10-27T14:37:01+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-27T14:37:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later.\n- If on the ESR channel, update to `115.44` (ESR 115 line) or `153.6` (ESR 153 line).","reach":"unknown","title":"Firefox: use-after-free in XML component fixed in version 159","impact":"medium","summary":"Firefox has a use-after-free bug in its XML component, where memory is used after it has been released. The sources do not say what an attacker can do with it beyond that memory-safety flaw.","category":"other","nicknames":[],"who_cares":["firefox","desktop","browser"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown: sources do not say what an attacker gets","analyst_note":"Check the NVD entry and Mozilla's advisory for the trigger conditions and the exploitability of the use-after-free.","how_to_check":"- Check the installed Firefox version against the fixed releases: `159`, ESR `115.44`, and ESR `153.6`.\n- unknown","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Teams and users running Firefox builds older than the fixed versions are affected. The sources do not say which configurations or content types trigger the bug, so unknown. Systems already on the fixed versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000885,"input_tokens":3238,"output_tokens":1122,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117939':15A,18A '-2026':14A,17A '115.44':78C '153.6':82C '159':12A,75C 'attack':50B 'beyond':55B 'browser':19B 'bug':29B 'compon':8A,33B,68C 'cve':13A,16A 'desktop':20B 'esr':77C,81C 'firefox':1A,21B,22B,74C,76C,80C 'fix':9A,72C 'flaw':60B 'free':5A,28B,64C 'memori':35B,58B 'memory-safeti':57B 'releas':42B 'safeti':59B 'say':47B 'sourc':44B 'use':3A,26B,37B,62C 'use-after-fre':2A,25B,61C 'version':11A 'vulner':70C 'xml':7A,32B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams and users running Firefox builds older than the fixed versions are affected. The sources do not say which configurations or content types trigger the bug, so unknown. Systems already on the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117939","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117939","severity":null,"published_at":"2026-10-27T14:16:49+00:00","modified_at":"2026-10-27T14:16:49+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}