Live › vulnerability › CVE-2026-117952
Go to dashboardFirefox's Networking component reads memory that was never initialized, which can leak data or cause unpredictable behavior. The sources do not say whether an attacker can reliably turn this into code execution or what data is exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Anyone running Firefox or Firefox ESR builds older than the fixed versions, on desktop or any platform that ships the affected Networking code. Managed fleets pinned to older ESR branches are the most likely to lag. The sources do not say whether any non-default configuration is needed.
No product ranges from the sources yet.
firefox --version (or check About Firefox) and compare against the fixed versions listed below.firefox --version against 115.44 and 153.6.159 or later.115.44 or later.153.6 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-117952")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.