{"id":"CVE-2026-117947","kind":"vulnerability","aliases":["CVE-2026-117947"],"related":[],"title":"Firefox: use-after-free in XML component may let attackers run code","description":"Use-after-free in the XML component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.","summary":"A use-after-free bug in the XML component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker gets beyond the memory corruption class of the flaw.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-browsers","firefox","other"],"not_affected_if":[],"how_to_check":null,"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","status":"open","published_at":"2026-10-27T14:16:50+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","triaged_at":"2026-10-27T14:35:41+00:00","updated_at":"2026-10-27T14:35:41+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T14:35:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update Firefox to `159` or later\n- Update Firefox ESR to `153.6` or later","reach":"unknown","title":"Firefox: use-after-free in XML component may let attackers run code","impact":"medium","summary":"A use-after-free bug in the XML component of Firefox was fixed in Firefox 159 and Firefox ESR 153.6. The sources do not say what an attacker gets beyond the memory corruption class of the flaw.","category":"other","nicknames":[],"who_cares":["firefox","desktop-browsers"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the Mozilla security advisory for the CVE-2026-117947 entry to confirm impact, trigger conditions and whether it is exploited.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone running Firefox builds older than 159 or Firefox ESR older than 153.6 is affected. The sources do not say which configurations or content are needed to trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000529,"input_tokens":3226,"output_tokens":412,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117947':16A,19A '-2026':15A,18A '153.6':44B,80C '159':40B,76C 'attack':11A,52B 'beyond':54B 'browser':22B 'bug':29B 'class':58B 'code':13A 'compon':8A,33B,69C 'corrupt':57B 'cve':14A,17A 'desktop':21B 'desktop-brows':20B 'esr':43B,79C 'firefox':1A,23B,35B,39B,42B,75C,78C 'fix':37B,73C 'flaw':61B 'free':5A,28B,65C 'get':53B 'let':10A 'may':9A 'memori':56B 'run':12A 'say':49B 'sourc':46B 'use':3A,26B,63C 'use-after-fre':2A,25B,62C 'vulner':71C 'xml':7A,32B,68C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Firefox builds older than 159 or Firefox ESR older than 153.6 is affected. The sources do not say which configurations or content are needed to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117947","severity":null,"published_at":"2026-10-27T14:16:50+00:00","modified_at":"2026-10-27T14:16:50+00:00","first_seen_at":"2026-10-27T14:32:23+00:00","fetched_at":"2026-10-27T14:32:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}