Live › vulnerability › CVE-2026-117948
Go to dashboardA use-after-free bug in Firefox's SVG handling lets a malicious page reuse freed memory. Depending on the attacker's control over that memory, this can crash the browser or let an attacker run code in it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR builds older than the fixed versions, including desktop users who open untrusted web content. Servers and applications that do not run a browser are not affected by this flaw. The sources do not say whether the bug is reachable without user interaction.
No product ranges from the sources yet.
firefox --version (or check Help > About) and compare against 159 for Firefox or 115.44 / 153.6 for ESR.159 or later.115.44 or 153.6, or later in the same branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117948")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.